CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,562)
page 1782 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-15843 | Med | 0.31 | 4.8 | 0.01 | Aug 25, 2018 | GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field. | ||
| CVE-2018-15842 | Med | 0.31 | 4.8 | 0.01 | Aug 25, 2018 | WolfCMS 0.8.3.1 has XSS via the /?/admin/page/add slug parameter. | ||
| CVE-2018-15570 | Med | 0.31 | 4.8 | 0.01 | Aug 20, 2018 | In waimai Super Cms 20150505, there is stored XSS via the /admin.php/Foodcat/editsave fcname parameter. | ||
| CVE-2018-14837 | Med | 0.31 | 4.8 | 0.01 | Aug 10, 2018 | Wolf CMS 0.8.3.1 has XSS in the Snippets tab, as demonstrated by a ?/admin/snippet/edit/1 URI. | ||
| CVE-2018-14976 | Med | 0.31 | 4.8 | 0.01 | Aug 6, 2018 | An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/category.php has XSS. | ||
| CVE-2018-14975 | Med | 0.31 | 4.8 | 0.01 | Aug 6, 2018 | An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/album.php has XSS. | ||
| CVE-2018-14974 | Med | 0.31 | 4.8 | 0.01 | Aug 6, 2018 | An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/news.php has XSS. | ||
| CVE-2018-14973 | Med | 0.31 | 4.8 | 0.01 | Aug 6, 2018 | An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/product.php has XSS. | ||
| CVE-2018-14972 | Med | 0.31 | 4.8 | 0.01 | Aug 6, 2018 | An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/down.php has XSS. | ||
| CVE-2018-14971 | Med | 0.31 | 4.8 | 0.01 | Aug 6, 2018 | An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/user.php has XSS. | ||
| CVE-2018-14970 | Med | 0.31 | 4.8 | 0.01 | Aug 6, 2018 | An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/slideshow.php has XSS. | ||
| CVE-2018-14969 | Med | 0.31 | 4.8 | 0.01 | Aug 6, 2018 | An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/system.php has XSS. | ||
| CVE-2018-14937 | Med | 0.31 | 4.8 | 0.01 | Aug 5, 2018 | The Add page option in my little forum 2.4.12 allows XSS via the Menu Link field. | ||
| CVE-2018-14936 | Med | 0.31 | 4.8 | 0.01 | Aug 5, 2018 | The Add page option in my little forum 2.4.12 allows XSS via the Title field. | ||
| CVE-2018-14419 | Med | 0.31 | 4.8 | 0.01 | Jul 20, 2018 | MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page. | ||
| CVE-2018-13999 | Med | 0.31 | 4.8 | 0.01 | Jul 12, 2018 | Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter (aka an article posted by an administrator). | ||
| CVE-2018-13998 | Med | 0.31 | 4.8 | 0.01 | Jul 12, 2018 | ClipperCMS 1.3.3 has stored XSS via the Full Name field of (1) Security -> Manager Users or (2) Security -> Web Users. | ||
| CVE-2017-16710 | Med | 0.31 | 4.8 | 0.01 | Jul 11, 2018 | Cross-site scripting (XSS) vulnerability in Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2018-12462 | Med | 0.31 | 4.8 | 0.01 | Jul 10, 2018 | NetIQ iManager 3.1.1 addresses potential XSS vulnerabilities. | ||
| CVE-2018-11124 | Med | 0.31 | 5.4 | 0.02 | Jul 6, 2018 | Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribute. |
- risk 0.31cvss 4.8epss 0.01
GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field.
- risk 0.31cvss 4.8epss 0.01
WolfCMS 0.8.3.1 has XSS via the /?/admin/page/add slug parameter.
- risk 0.31cvss 4.8epss 0.01
In waimai Super Cms 20150505, there is stored XSS via the /admin.php/Foodcat/editsave fcname parameter.
- risk 0.31cvss 4.8epss 0.01
Wolf CMS 0.8.3.1 has XSS in the Snippets tab, as demonstrated by a ?/admin/snippet/edit/1 URI.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/category.php has XSS.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/album.php has XSS.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/news.php has XSS.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/product.php has XSS.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/down.php has XSS.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/user.php has XSS.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/slideshow.php has XSS.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/system.php has XSS.
- risk 0.31cvss 4.8epss 0.01
The Add page option in my little forum 2.4.12 allows XSS via the Menu Link field.
- risk 0.31cvss 4.8epss 0.01
The Add page option in my little forum 2.4.12 allows XSS via the Title field.
- risk 0.31cvss 4.8epss 0.01
MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page.
- risk 0.31cvss 4.8epss 0.01
Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter (aka an article posted by an administrator).
- risk 0.31cvss 4.8epss 0.01
ClipperCMS 1.3.3 has stored XSS via the Full Name field of (1) Security -> Manager Users or (2) Security -> Web Users.
- risk 0.31cvss 4.8epss 0.01
Cross-site scripting (XSS) vulnerability in Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.31cvss 4.8epss 0.01
NetIQ iManager 3.1.1 addresses potential XSS vulnerabilities.
- risk 0.31cvss 5.4epss 0.02
Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribute.