CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,562)
page 1781 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-17835 | Med | 0.31 | 4.8 | 0.01 | Oct 1, 2018 | An issue was discovered in GetSimple CMS 3.3.15. An administrator can insert stored XSS via the admin/settings.php Custom Permalink Structure parameter, which injects the XSS payload into any page created at the admin/pages.php URI. | ||
| CVE-2018-9081 | Med | 0.31 | 4.7 | 0.01 | Sep 28, 2018 | For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible… | ||
| CVE-2018-1246 | Med | 0.31 | 4.7 | 0.01 | Sep 28, 2018 | Dell EMC Unity and UnityVSA contains reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or Java Script code to Unisphere, which is then… | ||
| CVE-2018-17369 | Med | 0.31 | 4.8 | 0.01 | Sep 23, 2018 | An issue was discovered in springboot_authority through 2017-03-06. There is stored XSS via the admin/role/edit roleKey, name, or description parameter. | ||
| CVE-2018-17300 | Med | 0.31 | 4.8 | 0.01 | Sep 21, 2018 | Stored XSS exists in CuppaCMS through 2018-09-03 via an administrator/#/component/table_manager/view/cu_menus section name. | ||
| CVE-2018-17044 | Med | 0.31 | 4.8 | 0.01 | Sep 14, 2018 | In YzmCMS 5.1, stored XSS exists via the admin/system_manage/user_config_add.html title parameter. | ||
| CVE-2018-17026 | Med | 0.31 | 4.8 | 0.01 | Sep 13, 2018 | admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page&name=error404 action, a different vulnerability than CVE-2018-10121. | ||
| CVE-2018-17024 | Med | 0.31 | 4.8 | 0.01 | Sep 13, 2018 | admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an add_page action. | ||
| CVE-2018-16805 | — | Med | 0.31 | 4.8 | 0.01 | Sep 10, 2018 | In b3log Solo 2.9.3, XSS in the Input page under the Publish Articles menu, with an ID of linkAddress stored in the link JSON field, allows remote attackers to inject arbitrary Web scripts or HTML via a crafted site name provided by an administrator. | |
| CVE-2018-16776 | Med | 0.31 | 4.8 | 0.01 | Sep 10, 2018 | wityCMS 0.6.2 has XSS via the "Site Name" field found in the "Contact" "Configuration" page. | ||
| CVE-2018-16775 | Med | 0.31 | 4.8 | 0.01 | Sep 10, 2018 | An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the site name in the "Categories" menu. | ||
| CVE-2018-16773 | Med | 0.31 | 4.8 | 0.01 | Sep 10, 2018 | EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field. | ||
| CVE-2018-16772 | Med | 0.31 | 4.8 | 0.01 | Sep 10, 2018 | Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new. | ||
| CVE-2018-0657 | Med | 0.31 | 4.8 | 0.01 | Sep 7, 2018 | Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG… | ||
| CVE-2018-0655 | Med | 0.31 | 4.8 | 0.01 | Sep 7, 2018 | Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page. | ||
| CVE-2018-0652 | Med | 0.31 | 4.8 | 0.01 | Sep 7, 2018 | Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the UserGroup Management section of admin page. | ||
| CVE-2018-16379 | Med | 0.31 | 4.8 | 0.01 | Sep 3, 2018 | Ogma CMS 0.4 Beta has XSS via the "Footer Text footer" field on the "Theme/Theme Options" screen. | ||
| CVE-2018-16374 | Med | 0.31 | 4.8 | 0.01 | Sep 3, 2018 | Frog CMS 0.9.5 has stored XSS via /admin/?/plugin/comment/settings. | ||
| CVE-2018-16348 | Med | 0.31 | 4.8 | 0.01 | Sep 2, 2018 | SeaCMS V6.61 has XSS via the admin_video.php v_content parameter, related to the site name. | ||
| CVE-2018-16346 | Med | 0.31 | 4.8 | 0.01 | Sep 2, 2018 | ChemCMS 1.0.6 has XSS via the "setting -> website information" field. |
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in GetSimple CMS 3.3.15. An administrator can insert stored XSS via the admin/settings.php Custom Permalink Structure parameter, which injects the XSS payload into any page created at the admin/pages.php URI.
- risk 0.31cvss 4.7epss 0.01
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible…
- risk 0.31cvss 4.7epss 0.01
Dell EMC Unity and UnityVSA contains reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or Java Script code to Unisphere, which is then…
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in springboot_authority through 2017-03-06. There is stored XSS via the admin/role/edit roleKey, name, or description parameter.
- risk 0.31cvss 4.8epss 0.01
Stored XSS exists in CuppaCMS through 2018-09-03 via an administrator/#/component/table_manager/view/cu_menus section name.
- risk 0.31cvss 4.8epss 0.01
In YzmCMS 5.1, stored XSS exists via the admin/system_manage/user_config_add.html title parameter.
- risk 0.31cvss 4.8epss 0.01
admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page&name=error404 action, a different vulnerability than CVE-2018-10121.
- risk 0.31cvss 4.8epss 0.01
admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an add_page action.
- risk 0.31cvss 4.8epss 0.01
In b3log Solo 2.9.3, XSS in the Input page under the Publish Articles menu, with an ID of linkAddress stored in the link JSON field, allows remote attackers to inject arbitrary Web scripts or HTML via a crafted site name provided by an administrator.
- risk 0.31cvss 4.8epss 0.01
wityCMS 0.6.2 has XSS via the "Site Name" field found in the "Contact" "Configuration" page.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the site name in the "Categories" menu.
- risk 0.31cvss 4.8epss 0.01
EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field.
- risk 0.31cvss 4.8epss 0.01
Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new.
- risk 0.31cvss 4.8epss 0.01
Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG…
- risk 0.31cvss 4.8epss 0.01
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page.
- risk 0.31cvss 4.8epss 0.01
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the UserGroup Management section of admin page.
- risk 0.31cvss 4.8epss 0.01
Ogma CMS 0.4 Beta has XSS via the "Footer Text footer" field on the "Theme/Theme Options" screen.
- risk 0.31cvss 4.8epss 0.01
Frog CMS 0.9.5 has stored XSS via /admin/?/plugin/comment/settings.
- risk 0.31cvss 4.8epss 0.01
SeaCMS V6.61 has XSS via the admin_video.php v_content parameter, related to the site name.
- risk 0.31cvss 4.8epss 0.01
ChemCMS 1.0.6 has XSS via the "setting -> website information" field.