VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,562)

page 1868 of 2,429
  • CVE-2023-4980MedSep 15, 2023
    Librenms
    Librenms
    risk 0.28cvss 5.4epss 0.01

    Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0.

  • CVE-2023-4979MedSep 15, 2023
    Librenms
    Librenms
    risk 0.28cvss 5.4epss 0.01

    Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.9.0.

  • CVE-2023-4843MedSep 8, 2023
    Pega
    Platform
    risk 0.28cvss 4.3epss 0.00

    Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however this field can only be modified by an authenticated administrative user.

  • CVE-2023-4710MedSep 1, 2023
    Totara
    Rm
    risk 0.28cvss 4.3epss 0.01

    A vulnerability classified as problematic was found in TOTVS RM 12.1. Affected by this vulnerability is an unknown functionality of the component Portal. The manipulation of the argument d leads to cross site scripting. The attack can be launched remotely. The identifier…

  • CVE-2023-4520MedAug 25, 2023
    WordPress
    Fv Flowplayer Video Player
    risk 0.28cvss 5.4epss 0.01

    The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_fv_player_user_video’ parameter saved via the 'save' function hooked via init, and the plugin is also vulnerable to Arbitrary Usermeta Update via the 'save' function in…

  • CVE-2023-4453MedAug 21, 2023
    Pimcore
    Pimcore
    risk 0.28cvss 5.4epss 0.01

    Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8.

  • CVE-2023-4433MedAug 19, 2023
    Agentejo
    Cockpit
    risk 0.28cvss 5.4epss 0.01

    Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.

  • CVE-2023-4395MedAug 17, 2023
    Agentejo
    Cockpit
    risk 0.28cvss 5.4epss 0.01

    Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.

  • CVE-2020-25915MedAug 11, 2023
    Thinkcmf
    Thinkcmf
    risk 0.28cvss 5.4epss 0.00

    Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted user_login.

  • CVE-2023-4196MedAug 6, 2023
    Agentejo
    Cockpit
    risk 0.28cvss 5.4epss 0.00

    Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.

  • CVE-2023-4145MedAug 3, 2023
    Pimcore
    Customer Management Framework
    risk 0.28cvss 5.4epss 0.01

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2.

  • CVE-2023-4111MedAug 3, 2023
    Phpjabbers
    Bus Reservation System
    risk 0.28cvss 4.3epss 0.03

    A vulnerability was found in PHP Jabbers Bus Reservation System 1.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument index/pickup_id leads to cross site scripting. The attack may be…

  • CVE-2023-4007MedJul 31, 2023
    PhpMyAdmin
    Phpmyfaq
    risk 0.28cvss 5.4epss 0.00

    Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.16.

  • CVE-2023-39151MedJul 26, 2023
    Jenkins Project
    Jenkins
    risk 0.28cvss 5.4epss 0.01

    Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents.

  • CVE-2023-37901MedJul 21, 2023
    Cern
    Indico
    risk 0.28cvss 5.4epss 0.01

    Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges (such as a…

  • CVE-2023-3821MedJul 21, 2023
    Pimcore
    Pimcore
    risk 0.28cvss 5.4epss 0.01

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4.

  • CVE-2023-3642MedJul 12, 2023
    GZ Scripts
    Vacation Rental Website
    risk 0.28cvss 4.3epss 0.00

    A vulnerability was found in GZ Scripts Vacation Rental Website 1.8 and classified as problematic. Affected by this issue is some unknown functionality of the file /VacationRentalWebsite/property/8/ad-has-principes/ of the component HTTP POST Request Handler. The manipulation of…

  • CVE-2023-3641MedJul 12, 2023
    khodakhah
    NodCMS
    risk 0.28cvss 4.3epss 0.00

    A vulnerability has been found in khodakhah NodCMS 3.4.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /en/blog-comment-4 of the component POST Request Handler. The manipulation of the argument comment_name/comment_content…

  • CVE-2023-3620MedJul 11, 2023
    Tarteaucitron
    Tarteaucitron
    risk 0.28cvss 5.4epss 0.01

    Cross-site Scripting (XSS) - Stored in GitHub repository amauric/tarteaucitron.js prior to v1.13.1.

  • CVE-2023-3565MedJul 10, 2023
    Nilsteampassnet
    Teampass
    risk 0.28cvss 5.4epss 0.01

    Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10.