CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,541)
page 1911 of 2,428| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-2550 | Med | 0.24 | 4.8 | 0.00 | May 5, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13. | ||
| CVE-2023-2427 | Med | 0.24 | 4.8 | 0.00 | May 5, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13. | ||
| CVE-2023-31045 | Med | 0.24 | 4.8 | 0.01 | Apr 24, 2023 | A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored… | ||
| CVE-2023-2191 | Med | 0.24 | 4.8 | 0.01 | Apr 20, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18. | ||
| CVE-2023-2102 | Med | 0.24 | 4.8 | 0.01 | Apr 15, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | ||
| CVE-2023-2014 | Med | 0.24 | 4.8 | 0.00 | Apr 13, 2023 | Cross-site Scripting (XSS) - Generic in GitHub repository microweber/microweber prior to 1.3.3. | ||
| CVE-2023-29112 | Low | 0.24 | 3.7 | 0.00 | Apr 11, 2023 | The SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exploitations, an… | ||
| CVE-2023-29110 | Low | 0.24 | 3.7 | 0.00 | Apr 11, 2023 | The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows the usage HTML tags. An authorized attacker can use some of the basic HTML codes such as heading, basic formatting and… | ||
| CVE-2023-1756 | Med | 0.24 | 4.7 | 0.00 | Apr 5, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||
| CVE-2023-1760 | Med | 0.24 | 4.8 | 0.01 | Mar 31, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||
| CVE-2023-1759 | Med | 0.24 | 4.8 | 0.00 | Mar 31, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||
| CVE-2023-1754 | Med | 0.24 | 4.7 | 0.01 | Mar 31, 2023 | Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||
| CVE-2023-1517 | Med | 0.24 | 4.8 | 0.00 | Mar 20, 2023 | Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19. | ||
| CVE-2023-27592 | Med | 0.24 | 4.8 | 0.01 | Mar 17, 2023 | Miniflux is a feed reader. Since v2.0.25, Miniflux will automatically proxy images served over HTTP to prevent mixed content errors. When an outbound request made by the Go HTTP client fails, the `html.ServerError` is returned unescaped without the expected Content Security… | ||
| CVE-2023-1312 | Med | 0.24 | 4.8 | 0.00 | Mar 10, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19. | ||
| CVE-2023-1286 | Med | 0.24 | 4.8 | 0.00 | Mar 9, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19. | ||
| CVE-2023-1243 | Med | 0.24 | 4.8 | 0.01 | Mar 7, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6. | ||
| CVE-2023-1239 | Med | 0.24 | 4.8 | 0.01 | Mar 7, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository answerdev/answer prior to 1.0.6. | ||
| CVE-2023-1197 | Med | 0.24 | 4.8 | 0.00 | Mar 6, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0. | ||
| CVE-2023-1081 | Med | 0.24 | 4.8 | 0.00 | Feb 28, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3. |
- risk 0.24cvss 4.8epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
- risk 0.24cvss 4.8epss 0.00
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
- risk 0.24cvss 4.8epss 0.01
A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored…
- risk 0.24cvss 4.8epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18.
- risk 0.24cvss 4.8epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- risk 0.24cvss 4.8epss 0.00
Cross-site Scripting (XSS) - Generic in GitHub repository microweber/microweber prior to 1.3.3.
- risk 0.24cvss 3.7epss 0.00
The SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exploitations, an…
- risk 0.24cvss 3.7epss 0.00
The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows the usage HTML tags. An authorized attacker can use some of the basic HTML codes such as heading, basic formatting and…
- risk 0.24cvss 4.7epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- risk 0.24cvss 4.8epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- risk 0.24cvss 4.8epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- risk 0.24cvss 4.7epss 0.01
Improper Neutralization of Input During Web Page Generation in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- risk 0.24cvss 4.8epss 0.00
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.
- risk 0.24cvss 4.8epss 0.01
Miniflux is a feed reader. Since v2.0.25, Miniflux will automatically proxy images served over HTTP to prevent mixed content errors. When an outbound request made by the Go HTTP client fails, the `html.ServerError` is returned unescaped without the expected Content Security…
- risk 0.24cvss 4.8epss 0.00
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
- risk 0.24cvss 4.8epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
- risk 0.24cvss 4.8epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
- risk 0.24cvss 4.8epss 0.01
Cross-site Scripting (XSS) - Reflected in GitHub repository answerdev/answer prior to 1.0.6.
- risk 0.24cvss 4.8epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0.
- risk 0.24cvss 4.8epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.