CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (46,817)
page 2019 of 2,341| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2008-1502 | 0.01 | — | 0.10 | Mar 25, 2008 | The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing… | |||
| CVE-2008-0460 | 0.01 | — | 0.15 | Jan 25, 2008 | Cross-site scripting (XSS) vulnerability in api.php in (1) MediaWiki 1.11 through 1.11.0rc1, 1.10 through 1.10.2, 1.9 through 1.9.4, and 1.8; and (2) the BotQuery extension for MediaWiki 1.7 and earlier; when Internet Explorer is used, allows remote attackers to inject arbitrary… | |||
| CVE-2008-0005 | 0.01 | — | 0.15 | Jan 12, 2008 | mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding. | |||
| CVE-2007-6421 | 0.01 | — | 0.08 | Jan 8, 2008 | Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL. | |||
| CVE-2007-6312 | 0.01 | — | 0.16 | Dec 11, 2007 | Cross-site scripting (XSS) vulnerability in the logon page in Web Reporting Tools portal in Websense Enterprise and Web Security Suite 6.3 allows remote attackers to inject arbitrary web script or HTML via the username field. | |||
| CVE-2007-3954 | 0.01 | — | 0.07 | Jul 24, 2007 | Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with SeaMonkey installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto… | |||
| CVE-2005-4838 | 0.01 | — | 0.08 | Dec 31, 2005 | Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in… | |||
| CVE-2005-0563 | 0.01 | — | 0.14 | Jun 14, 2005 | Cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA) component in Exchange Server 5.5 allows remote attackers to inject arbitrary web script or HTML via an email message with an encoded javascript: URL ("javAsc ript:") in an IMG tag. | |||
| CVE-2003-0044 | 0.01 | — | 0.09 | Feb 7, 2003 | Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML. | |||
| CVE-2026-78195 | — | 0.00 | — | 0.00 | Aug 28, 2026 | Rejected reason: Rejecting as a duplicate of CVE-2026-78047 | ||
| CVE-2026-44701 | low | 0.00 | — | — | Aug 26, 2026 | ### Summary An HTML Injection vulnerability exists in the user group creation functionality that allows an attacker to inject arbitrary HTML content into the application interface. The vulnerability occurs when user-supplied input in the group name field is not properly… | ||
| CVE-2026-78563 | — | 0.00 | — | 0.00 | Aug 25, 2026 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage. | ||
| CVE-2026-54181 | 0.00 | — | — | Aug 20, 2026 | ## Summary The Blade template for the `color` column type (`src/resources/views/crud/columns/color.blade.php`) has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because `$column['escaped']` defaults to `true`, values… | |||
| CVE-2026-53992 | Med | 0.00 | 6.1 | 0.00 | Aug 5, 2026 | ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the start_date and end_date GET parameters, which are echoed unescaped… | ||
| CVE-2026-67617 | Med | 0.00 | 4.8 | 0.00 | Aug 3, 2026 | Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tag_names parameter of the GET… | ||
| CVE-2026-67612 | Med | 0.00 | 4.8 | 0.00 | Aug 3, 2026 | OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters… | ||
| CVE-2026-18243 | Med | 0.00 | — | 0.00 | Aug 3, 2026 | Certain HP DesignJet products may be potentially vulnerable to cross-site scripting (XSS), which may allow unauthenticated HTTP requests to view print job previews. | ||
| CVE-2026-68583 | Med | 0.00 | 5.4 | 0.00 | Aug 2, 2026 | luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the… | ||
| CVE-2026-52232 | Med | 0.00 | 6.1 | 0.00 | Jul 31, 2026 | A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL. | ||
| CVE-2026-18481 | Hig | 0.00 | 7.3 | 0.00 | Jul 31, 2026 | Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a … |
- CVE-2008-1502Mar 25, 2008risk 0.01cvss —epss 0.10
The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing…
- CVE-2008-0460Jan 25, 2008risk 0.01cvss —epss 0.15
Cross-site scripting (XSS) vulnerability in api.php in (1) MediaWiki 1.11 through 1.11.0rc1, 1.10 through 1.10.2, 1.9 through 1.9.4, and 1.8; and (2) the BotQuery extension for MediaWiki 1.7 and earlier; when Internet Explorer is used, allows remote attackers to inject arbitrary…
- CVE-2008-0005Jan 12, 2008risk 0.01cvss —epss 0.15
mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.
- CVE-2007-6421Jan 8, 2008risk 0.01cvss —epss 0.08
Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.
- CVE-2007-6312Dec 11, 2007risk 0.01cvss —epss 0.16
Cross-site scripting (XSS) vulnerability in the logon page in Web Reporting Tools portal in Websense Enterprise and Web Security Suite 6.3 allows remote attackers to inject arbitrary web script or HTML via the username field.
- CVE-2007-3954Jul 24, 2007risk 0.01cvss —epss 0.07
Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with SeaMonkey installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto…
- CVE-2005-4838Dec 31, 2005risk 0.01cvss —epss 0.08
Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in…
- CVE-2005-0563Jun 14, 2005risk 0.01cvss —epss 0.14
Cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA) component in Exchange Server 5.5 allows remote attackers to inject arbitrary web script or HTML via an email message with an encoded javascript: URL ("javAsc ript:") in an IMG tag.
- CVE-2003-0044Feb 7, 2003risk 0.01cvss —epss 0.09
Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.
- CVE-2026-78195Aug 28, 2026risk 0.00cvss —epss 0.00
Rejected reason: Rejecting as a duplicate of CVE-2026-78047
- risk 0.00cvss —epss —
### Summary An HTML Injection vulnerability exists in the user group creation functionality that allows an attacker to inject arbitrary HTML content into the application interface. The vulnerability occurs when user-supplied input in the group name field is not properly…
- CVE-2026-78563Aug 25, 2026risk 0.00cvss —epss 0.00
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
- CVE-2026-54181Aug 20, 2026risk 0.00cvss —epss —
## Summary The Blade template for the `color` column type (`src/resources/views/crud/columns/color.blade.php`) has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because `$column['escaped']` defaults to `true`, values…
- risk 0.00cvss 6.1epss 0.00
ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the start_date and end_date GET parameters, which are echoed unescaped…
- risk 0.00cvss 4.8epss 0.00
Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tag_names parameter of the GET…
- risk 0.00cvss 4.8epss 0.00
OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters…
- risk 0.00cvss —epss 0.00
Certain HP DesignJet products may be potentially vulnerable to cross-site scripting (XSS), which may allow unauthenticated HTTP requests to view print job previews.
- risk 0.00cvss 5.4epss 0.00
luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the…
- risk 0.00cvss 6.1epss 0.00
A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL.
- risk 0.00cvss 7.3epss 0.00
Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a …