CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,562)
page 1861 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-39318 | Med | 0.28 | 5.4 | 0.00 | Jul 31, 2024 | The Ibexa Admin UI Bundle contains all the necessary parts to run the Ibexa DXP Back Office interface. The file upload widget is vulnerable to XSS payloads in filenames. Access permission to upload files is required. As such, in most cases only authenticated editors and… | ||
| CVE-2024-7321 | Med | 0.28 | 4.3 | 0.01 | Jul 31, 2024 | A vulnerability classified as problematic was found in itsourcecode Online Blood Bank Management System 1.0. This vulnerability affects unknown code of the file signup.php of the component User Registration Handler. The manipulation of the argument user leads to cross site… | ||
| CVE-2024-25090 | Med | 0.28 | 5.4 | 0.01 | Jul 26, 2024 | Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller… | ||
| CVE-2024-3938 | Med | 0.28 | 5.4 | 0.00 | Jul 25, 2024 | The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a http://localhost:8082/dotAdmin/#/public/lo… | ||
| CVE-2024-38503 | Med | 0.28 | 5.4 | 0.01 | Jul 22, 2024 | When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are… | ||
| CVE-2024-39126 | Med | 0.28 | 5.4 | 0.00 | Jul 17, 2024 | Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents. | ||
| CVE-2024-39125 | Med | 0.28 | 5.4 | 0.00 | Jul 17, 2024 | Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header. | ||
| CVE-2024-39124 | Med | 0.28 | 5.4 | 0.00 | Jul 17, 2024 | In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS. | ||
| CVE-2024-32981 | Med | 0.28 | 5.4 | 0.00 | Jul 17, 2024 | Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. In affected versions a bad actor with access to edit content in the CMS could add send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload… | ||
| CVE-2024-39863 | Med | 0.28 | 5.4 | 0.01 | Jul 17, 2024 | Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue. | ||
| CVE-2024-21154 | Med | 0.28 | 4.3 | 0.00 | Jul 16, 2024 | Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Human Resources). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise… | ||
| CVE-2024-6025 | Med | 0.28 | 5.4 | 0.00 | Jul 11, 2024 | The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks | ||
| CVE-2024-27095 | Med | 0.28 | 5.4 | 0.00 | Jul 10, 2024 | Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1. | ||
| CVE-2024-39031 | Med | 0.28 | 5.4 | 0.01 | Jul 9, 2024 | In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and… | ||
| CVE-2024-3410 | Med | 0.28 | 4.3 | 0.00 | Jul 9, 2024 | The DN Footer Contacts WordPress plugin before 1.6.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in… | ||
| CVE-2024-39308 | Med | 0.28 | 5.4 | 0.01 | Jul 8, 2024 | RailsAdmin is a Rails engine that provides an interface for managing data. RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute. Upgrade to 3.1.3 or 2.2.2 (to be released). | ||
| CVE-2024-38857 | Med | 0.28 | 4.3 | 0.00 | Jul 2, 2024 | Improper neutralization of input in Checkmk before versions 2.3.0p8, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows attackers to craft malicious links that can facilitate phishing attacks. | ||
| CVE-2024-39310 | Med | 0.28 | 5.4 | 0.00 | Jul 1, 2024 | The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `post_title` parameter in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with… | ||
| CVE-2024-6355 | Med | 0.28 | 4.3 | 0.00 | Jun 26, 2024 | A vulnerability was found in Genexis Tilgin Fiber Home Gateway HG1522 CSx000-01_09_01_12. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /status/product_info/. The manipulation of the argument product_info leads to… | ||
| CVE-2024-38527 | Med | 0.28 | 5.4 | 0.00 | Jun 26, 2024 | ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrams. Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting (XSS). The comment… |
- risk 0.28cvss 5.4epss 0.00
The Ibexa Admin UI Bundle contains all the necessary parts to run the Ibexa DXP Back Office interface. The file upload widget is vulnerable to XSS payloads in filenames. Access permission to upload files is required. As such, in most cases only authenticated editors and…
- risk 0.28cvss 4.3epss 0.01
A vulnerability classified as problematic was found in itsourcecode Online Blood Bank Management System 1.0. This vulnerability affects unknown code of the file signup.php of the component User Registration Handler. The manipulation of the argument user leads to cross site…
- risk 0.28cvss 5.4epss 0.01
Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller…
- risk 0.28cvss 5.4epss 0.00
The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a http://localhost:8082/dotAdmin/#/public/lo…
- risk 0.28cvss 5.4epss 0.01
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are…
- risk 0.28cvss 5.4epss 0.00
Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.
- risk 0.28cvss 5.4epss 0.00
Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.
- risk 0.28cvss 5.4epss 0.00
In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.
- risk 0.28cvss 5.4epss 0.00
Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. In affected versions a bad actor with access to edit content in the CMS could add send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload…
- risk 0.28cvss 5.4epss 0.01
Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue.
- risk 0.28cvss 4.3epss 0.00
Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Human Resources). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise…
- risk 0.28cvss 5.4epss 0.00
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks
- risk 0.28cvss 5.4epss 0.00
Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1.
- risk 0.28cvss 5.4epss 0.01
In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and…
- risk 0.28cvss 4.3epss 0.00
The DN Footer Contacts WordPress plugin before 1.6.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in…
- risk 0.28cvss 5.4epss 0.01
RailsAdmin is a Rails engine that provides an interface for managing data. RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute. Upgrade to 3.1.3 or 2.2.2 (to be released).
- risk 0.28cvss 4.3epss 0.00
Improper neutralization of input in Checkmk before versions 2.3.0p8, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows attackers to craft malicious links that can facilitate phishing attacks.
- risk 0.28cvss 5.4epss 0.00
The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `post_title` parameter in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with…
- risk 0.28cvss 4.3epss 0.00
A vulnerability was found in Genexis Tilgin Fiber Home Gateway HG1522 CSx000-01_09_01_12. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /status/product_info/. The manipulation of the argument product_info leads to…
- risk 0.28cvss 5.4epss 0.00
ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrams. Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting (XSS). The comment…