CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,562)
page 1784 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-11330 | Med | 0.31 | 4.8 | 0.01 | May 21, 2018 | An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted. | ||
| CVE-2018-11208 | Med | 0.31 | 4.8 | 0.01 | May 16, 2018 | An issue was discovered in Z-BlogPHP 2.0.0. There is a persistent XSS that allows remote attackers to inject arbitrary web script or HTML into background web site settings via the "copyright information office" field. NOTE: the vendor indicates that the product was not intended… | ||
| CVE-2018-1000172 | Med | 0.31 | 4.8 | 0.01 | Apr 30, 2018 | Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text. This attack appears to be exploitable via a victim viewing the image in the administrator page. This vulnerability appears to have been fixed in… | ||
| CVE-2018-10570 | Med | 0.31 | 4.8 | 0.01 | Apr 30, 2018 | Frog CMS 0.9.5 has XSS in /install/index.php via the ['config']['admin_username'] field. | ||
| CVE-2018-10430 | Med | 0.31 | 4.8 | 0.01 | Apr 26, 2018 | An issue was discovered in DiliCMS (aka DiligentCMS) 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting->site setting" of admin/index.php. | ||
| CVE-2018-6518 | Med | 0.31 | 4.8 | 0.01 | Apr 26, 2018 | Composr CMS 10.0.13 has XSS via the site_name parameter in a page=admin-setupwizard&type=step3 request to /adminzone/index.php. | ||
| CVE-2017-14740 | Med | 0.31 | 4.8 | 0.01 | Apr 26, 2018 | Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the Menu ID when adding a menu. | ||
| CVE-2018-10422 | Med | 0.31 | 4.8 | 0.01 | Apr 26, 2018 | An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field. | ||
| CVE-2018-10391 | Med | 0.31 | 4.8 | 0.01 | Apr 26, 2018 | An issue was discovered in WUZHI CMS 4.1.0. There is XSS via the email parameter to the index.php?m=member&v=register URI. | ||
| CVE-2018-10368 | Med | 0.31 | 4.8 | 0.01 | Apr 25, 2018 | An issue was discovered in WUZHI CMS 4.1.0. The "Extension Module -> System Announcement" feature has Stored XSS via an announcement. | ||
| CVE-2018-10367 | Med | 0.31 | 4.8 | 0.01 | Apr 25, 2018 | An issue was discovered in WUZHI CMS 4.1.0. The content-management feature has Stored XSS via the title or content section. | ||
| CVE-2018-10320 | Med | 0.31 | 4.8 | 0.01 | Apr 24, 2018 | Frog CMS 0.9.5 has XSS via the admin/?/layout/edit layout[name] parameter, aka Edit Layout. | ||
| CVE-2018-10319 | Med | 0.31 | 4.8 | 0.01 | Apr 24, 2018 | Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit snippet[name] parameter, aka Edit Snippet. | ||
| CVE-2018-10318 | Med | 0.31 | 4.8 | 0.01 | Apr 24, 2018 | Frog CMS 0.9.5 has XSS via the admin/?/page/edit page[keywords] parameter, aka Edit Page Metadata. | ||
| CVE-2018-10234 | Med | 0.31 | 4.8 | 0.01 | Apr 23, 2018 | Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options§ion=account page. | ||
| CVE-2018-9169 | Med | 0.31 | 4.8 | 0.01 | Apr 16, 2018 | Z-BlogPHP 1.5.1 has XSS via the zb_users/plugin/AppCentre/plugin_edit.php app_id parameter. The component must be accessed directly by an administrator, or through CSRF. | ||
| CVE-2018-10121 | Med | 0.31 | 4.8 | 0.01 | Apr 16, 2018 | plugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the title section of an admin/index.php?id=pages&action=edit_page&name=error404 (aka Edit 404 page) action. | ||
| CVE-2018-10096 | Med | 0.31 | 4.8 | 0.01 | Apr 13, 2018 | joyplus-cms 1.6.0 has XSS via the device_name parameter in a manager/admin_ajax.php?action=save flag=add request. | ||
| CVE-2017-0365 | Med | 0.31 | 4.7 | 0.01 | Apr 13, 2018 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations. | ||
| CVE-2018-10073 | Med | 0.31 | 4.8 | 0.01 | Apr 12, 2018 | joyplus-cms 1.6.0 has XSS in manager/admin_vod.php via the keyword parameter. |
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in Z-BlogPHP 2.0.0. There is a persistent XSS that allows remote attackers to inject arbitrary web script or HTML into background web site settings via the "copyright information office" field. NOTE: the vendor indicates that the product was not intended…
- risk 0.31cvss 4.8epss 0.01
Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text. This attack appears to be exploitable via a victim viewing the image in the administrator page. This vulnerability appears to have been fixed in…
- risk 0.31cvss 4.8epss 0.01
Frog CMS 0.9.5 has XSS in /install/index.php via the ['config']['admin_username'] field.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in DiliCMS (aka DiligentCMS) 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting->site setting" of admin/index.php.
- risk 0.31cvss 4.8epss 0.01
Composr CMS 10.0.13 has XSS via the site_name parameter in a page=admin-setupwizard&type=step3 request to /adminzone/index.php.
- risk 0.31cvss 4.8epss 0.01
Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the Menu ID when adding a menu.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in WUZHI CMS 4.1.0. There is XSS via the email parameter to the index.php?m=member&v=register URI.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in WUZHI CMS 4.1.0. The "Extension Module -> System Announcement" feature has Stored XSS via an announcement.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in WUZHI CMS 4.1.0. The content-management feature has Stored XSS via the title or content section.
- risk 0.31cvss 4.8epss 0.01
Frog CMS 0.9.5 has XSS via the admin/?/layout/edit layout[name] parameter, aka Edit Layout.
- risk 0.31cvss 4.8epss 0.01
Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit snippet[name] parameter, aka Edit Snippet.
- risk 0.31cvss 4.8epss 0.01
Frog CMS 0.9.5 has XSS via the admin/?/page/edit page[keywords] parameter, aka Edit Page Metadata.
- risk 0.31cvss 4.8epss 0.01
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options§ion=account page.
- risk 0.31cvss 4.8epss 0.01
Z-BlogPHP 1.5.1 has XSS via the zb_users/plugin/AppCentre/plugin_edit.php app_id parameter. The component must be accessed directly by an administrator, or through CSRF.
- risk 0.31cvss 4.8epss 0.01
plugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the title section of an admin/index.php?id=pages&action=edit_page&name=error404 (aka Edit 404 page) action.
- risk 0.31cvss 4.8epss 0.01
joyplus-cms 1.6.0 has XSS via the device_name parameter in a manager/admin_ajax.php?action=save flag=add request.
- risk 0.31cvss 4.7epss 0.01
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations.
- risk 0.31cvss 4.8epss 0.01
joyplus-cms 1.6.0 has XSS in manager/admin_vod.php via the keyword parameter.