CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,562)
page 1788 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-5363 | Med | 0.31 | 4.8 | 0.01 | Jan 12, 2018 | The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[enabled_languages][en] or wpglobus_option[enabled_languages][fr] (or any other language) parameter to wp-admin/options.php. | ||
| CVE-2018-5362 | Med | 0.31 | 4.8 | 0.01 | Jan 12, 2018 | The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][page] parameter to wp-admin/options.php. | ||
| CVE-2018-5284 | Med | 0.31 | 4.8 | 0.01 | Jan 8, 2018 | The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php. | ||
| CVE-2018-5078 | Med | 0.31 | 4.8 | 0.00 | Jan 3, 2018 | Online Ticket Booking has XSS via the admin/eventlist.php cast parameter. | ||
| CVE-2018-5077 | Med | 0.31 | 4.8 | 0.00 | Jan 3, 2018 | Online Ticket Booking has XSS via the admin/movieedit.php moviename parameter. | ||
| CVE-2018-5076 | Med | 0.31 | 4.8 | 0.00 | Jan 3, 2018 | Online Ticket Booking has XSS via the admin/newsedit.php newstitle parameter. | ||
| CVE-2018-5075 | Med | 0.31 | 4.8 | 0.00 | Jan 3, 2018 | Online Ticket Booking has XSS via the admin/snacks_edit.php snacks_name parameter. | ||
| CVE-2018-5074 | Med | 0.31 | 4.8 | 0.00 | Jan 3, 2018 | Online Ticket Booking has XSS via the admin/manageownerlist.php contact parameter. | ||
| CVE-2018-5072 | Med | 0.31 | 4.8 | 0.00 | Jan 3, 2018 | Online Ticket Booking has XSS via the admin/sitesettings.php keyword parameter. | ||
| CVE-2017-1000457 | Med | 0.31 | 4.8 | 0.01 | Jan 2, 2018 | Cross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script or HTML via the helpkey parameter. Exploitation requires authenticated reflected cross-site scripting for user accounts assigned either the… | ||
| CVE-2017-17089 | Med | 0.31 | 4.8 | 0.01 | Dec 30, 2017 | custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS attacks via the description field in the custom command functionality. | ||
| CVE-2017-17988 | Med | 0.31 | 4.8 | 0.00 | Dec 30, 2017 | PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_add.php event_title parameter. | ||
| CVE-2017-17986 | Med | 0.31 | 4.8 | 0.00 | Dec 30, 2017 | PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/caste_view.php comm_id parameter. | ||
| CVE-2017-17985 | Med | 0.31 | 4.8 | 0.00 | Dec 30, 2017 | PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/state_view.php cou_id parameter. | ||
| CVE-2017-17984 | Med | 0.31 | 4.8 | 0.00 | Dec 30, 2017 | PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter. | ||
| CVE-2017-17940 | Med | 0.31 | 4.8 | 0.00 | Dec 28, 2017 | PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php. | ||
| CVE-2017-17938 | Med | 0.31 | 4.8 | 0.00 | Dec 28, 2017 | PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter. | ||
| CVE-2017-16768 | Med | 0.31 | 4.8 | 0.01 | Dec 27, 2017 | Cross-site scripting (XSS) vulnerability in User Policy editor in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary HTML via the name parameter. | ||
| CVE-2017-17929 | Med | 0.31 | 4.8 | 0.01 | Dec 27, 2017 | PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter. | ||
| CVE-2017-17925 | Med | 0.31 | 4.8 | 0.01 | Dec 27, 2017 | PHP Scripts Mall Professional Service Script has XSS via the admin/general_settingupd.php website_title parameter. |
- risk 0.31cvss 4.8epss 0.01
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[enabled_languages][en] or wpglobus_option[enabled_languages][fr] (or any other language) parameter to wp-admin/options.php.
- risk 0.31cvss 4.8epss 0.01
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][page] parameter to wp-admin/options.php.
- risk 0.31cvss 4.8epss 0.01
The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.
- risk 0.31cvss 4.8epss 0.00
Online Ticket Booking has XSS via the admin/eventlist.php cast parameter.
- risk 0.31cvss 4.8epss 0.00
Online Ticket Booking has XSS via the admin/movieedit.php moviename parameter.
- risk 0.31cvss 4.8epss 0.00
Online Ticket Booking has XSS via the admin/newsedit.php newstitle parameter.
- risk 0.31cvss 4.8epss 0.00
Online Ticket Booking has XSS via the admin/snacks_edit.php snacks_name parameter.
- risk 0.31cvss 4.8epss 0.00
Online Ticket Booking has XSS via the admin/manageownerlist.php contact parameter.
- risk 0.31cvss 4.8epss 0.00
Online Ticket Booking has XSS via the admin/sitesettings.php keyword parameter.
- risk 0.31cvss 4.8epss 0.01
Cross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script or HTML via the helpkey parameter. Exploitation requires authenticated reflected cross-site scripting for user accounts assigned either the…
- risk 0.31cvss 4.8epss 0.01
custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS attacks via the description field in the custom command functionality.
- risk 0.31cvss 4.8epss 0.00
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_add.php event_title parameter.
- risk 0.31cvss 4.8epss 0.00
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/caste_view.php comm_id parameter.
- risk 0.31cvss 4.8epss 0.00
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/state_view.php cou_id parameter.
- risk 0.31cvss 4.8epss 0.00
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter.
- risk 0.31cvss 4.8epss 0.00
PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php.
- risk 0.31cvss 4.8epss 0.00
PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter.
- risk 0.31cvss 4.8epss 0.01
Cross-site scripting (XSS) vulnerability in User Policy editor in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary HTML via the name parameter.
- risk 0.31cvss 4.8epss 0.01
PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter.
- risk 0.31cvss 4.8epss 0.01
PHP Scripts Mall Professional Service Script has XSS via the admin/general_settingupd.php website_title parameter.