CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,562)
page 1797 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-50577 | Med | 0.30 | 4.6 | 0.00 | Oct 28, 2024 | In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings | ||
| CVE-2024-50576 | Med | 0.30 | 4.6 | 0.00 | Oct 28, 2024 | In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest | ||
| CVE-2024-48927 | Med | 0.30 | 4.6 | 0.00 | Oct 22, 2024 | Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. There is a potential risk of code execution for Backoffice users when they… | ||
| CVE-2024-8149 | Med | 0.30 | 4.6 | 0.00 | Oct 4, 2024 | There is a reflected Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 and 11.2 that may allow a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary… | ||
| CVE-2024-43810 | Med | 0.30 | 4.6 | 0.00 | Aug 16, 2024 | In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin | ||
| CVE-2024-43807 | Med | 0.30 | 4.6 | 0.00 | Aug 16, 2024 | In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page | ||
| CVE-2024-6362 | Med | 0.30 | 4.6 | 0.00 | Jul 29, 2024 | The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site… | ||
| CVE-2024-41825 | Med | 0.30 | 4.6 | 0.00 | Jul 22, 2024 | In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab | ||
| CVE-2024-3919 | Med | 0.30 | 4.6 | 0.00 | Jul 13, 2024 | The OpenPGP Form Encryption for WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored… | ||
| CVE-2024-4271 | Med | 0.30 | 4.6 | 0.00 | Jun 14, 2024 | The SVGator WordPress plugin through 1.2.6 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks. | ||
| CVE-2024-2218 | Med | 0.30 | 4.6 | 0.00 | Jun 14, 2024 | The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example… | ||
| CVE-2024-36417 | Med | 0.30 | 5.7 | 0.00 | Jun 10, 2024 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, an unverified IFrame can be added some some inputs, which could allow for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 contain a fix for this… | ||
| CVE-2022-43384 | Med | 0.30 | 4.6 | 0.00 | May 30, 2024 | IBM Aspera Console 3.4.0 through 3.4.2 PL5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. … | ||
| CVE-2024-36374 | Med | 0.30 | 4.6 | 0.00 | May 29, 2024 | In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible | ||
| CVE-2024-36373 | Med | 0.30 | 4.6 | 0.00 | May 29, 2024 | In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible | ||
| CVE-2024-36372 | Med | 0.30 | 4.6 | 0.00 | May 29, 2024 | In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible | ||
| CVE-2024-36371 | Med | 0.30 | 4.6 | 0.00 | May 29, 2024 | In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible | ||
| CVE-2024-36370 | Med | 0.30 | 4.6 | 0.00 | May 29, 2024 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible | ||
| CVE-2024-36369 | Med | 0.30 | 4.6 | 0.00 | May 29, 2024 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible | ||
| CVE-2024-36368 | Med | 0.30 | 4.6 | 0.00 | May 29, 2024 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible |
- risk 0.30cvss 4.6epss 0.00
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings
- risk 0.30cvss 4.6epss 0.00
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest
- risk 0.30cvss 4.6epss 0.00
Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13.5.2, 10.x prior to 10.8.7, and 8.x prior to 8.18.15. There is a potential risk of code execution for Backoffice users when they…
- risk 0.30cvss 4.6epss 0.00
There is a reflected Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.1 and 11.2 that may allow a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary…
- risk 0.30cvss 4.6epss 0.00
In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin
- risk 0.30cvss 4.6epss 0.00
In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page
- risk 0.30cvss 4.6epss 0.00
The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site…
- risk 0.30cvss 4.6epss 0.00
In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab
- risk 0.30cvss 4.6epss 0.00
The OpenPGP Form Encryption for WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored…
- risk 0.30cvss 4.6epss 0.00
The SVGator WordPress plugin through 1.2.6 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
- risk 0.30cvss 4.6epss 0.00
The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example…
- risk 0.30cvss 5.7epss 0.00
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, an unverified IFrame can be added some some inputs, which could allow for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 contain a fix for this…
- risk 0.30cvss 4.6epss 0.00
IBM Aspera Console 3.4.0 through 3.4.2 PL5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. …
- risk 0.30cvss 4.6epss 0.00
In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible
- risk 0.30cvss 4.6epss 0.00
In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible
- risk 0.30cvss 4.6epss 0.00
In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible
- risk 0.30cvss 4.6epss 0.00
In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible
- risk 0.30cvss 4.6epss 0.00
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible
- risk 0.30cvss 4.6epss 0.00
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible
- risk 0.30cvss 4.6epss 0.00
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible