VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,541)

page 2050 of 2,428
  • CVE-2023-28820LowApr 28, 2023
    Concrete5
    Concrete5
    risk 0.06cvss 2.0epss 0.00

    Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.

  • CVE-2016-15022LowJan 29, 2023
    Cimage
    Cimage
    risk 0.06cvss 2.0epss 0.01

    A vulnerability was found in mosbth cimage up to 0.7.18. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file check_system.php. The manipulation of the argument $_SERVER['SERVER_SOFTWARE'] leads to cross site scripting. The…

  • CVE-2021-4303LowJan 5, 2023
    shannah
    Xataface
    risk 0.06cvss 2.0epss 0.01

    A vulnerability, which was classified as problematic, has been found in shannah Xataface up to 2.x. Affected by this issue is the function testftp of the file install/install_form.js.php of the component Installer. The manipulation leads to cross site scripting. The attack may…

  • CVE-2015-6058Oct 14, 2015
    Microsoft
    Edge
    risk 0.06cvss —epss 0.70

    Microsoft Edge mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors, aka "Microsoft Edge XSS Filter Bypass."

  • CVE-2012-1007Feb 7, 2012
    Apache
    Struts
    risk 0.06cvss —epss 0.33

    Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or…

  • CVE-2011-1772May 13, 2011
    Apache
    Struts
    risk 0.06cvss —epss 0.33

    Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an…

  • CVE-2010-2103May 27, 2010
    Apache
    Axis2
    risk 0.06cvss —epss 0.35

    Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers…

  • CVE-2007-6388Jan 8, 2008
    Apache
    HTTP Server
    risk 0.06cvss —epss 0.76

    Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2007-2581May 9, 2007
    Microsoft
    Windows Server 2003
    risk 0.06cvss —epss 0.36

    Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) in "every main page," as…

  • CVE-2006-1193Jun 13, 2006
    Microsoft
    Exchange Server
    risk 0.06cvss —epss 0.40

    Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access (OWA), allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing."

  • CVE-2006-0254Jan 18, 2006
    Apache
    Geronimo
    risk 0.06cvss —epss 0.32

    Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log…

  • CVE-2025-64059LowSep 13, 2026
    Grav CMS
    Grav
    risk 0.05cvss 1.8epss 0.00

    Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content.

  • CVE-2013-7389Jul 7, 2014
    Dlink
    DIR-645 Router
    risk 0.05cvss —epss 0.28

    Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. A1) with firmware before 1.04B11 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceid parameter to parentalcontrols/bind.php, (2) RESULT parameter to info.php, or (3)…

  • CVE-2014-2908Apr 25, 2014
    Siemens Foundation
    SIMATIC S7-1200
    risk 0.05cvss —epss 0.21

    Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-3180Sep 11, 2013
    Microsoft
    Sharepoint Server
    risk 0.05cvss —epss 0.66

    Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1 and SP2 and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted POST request, aka "POST XSS Vulnerability."

  • CVE-2013-3179Sep 11, 2013
    Microsoft
    Sharepoint Server
    risk 0.05cvss —epss 0.22

    Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "SharePoint XSS Vulnerability."

  • CVE-2011-1976Aug 10, 2011
    Microsoft
    Visual Studio
    risk 0.05cvss —epss 0.21

    Cross-site scripting (XSS) vulnerability in the Report Viewer Control in Microsoft Visual Studio 2005 SP1 and Report Viewer 2005 SP1 allows remote attackers to inject arbitrary web script or HTML via a parameter in a data source, aka "Report Viewer Controls XSS Vulnerability."

  • CVE-2011-2179Jun 14, 2011
    Nagios
    Nagios
    risk 0.05cvss —epss 0.26

    Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an (a) command action or a (b) hosts action.

  • CVE-2011-0959May 20, 2011
    Cisco Systems, Inc.
    Unified Operations Manager
    risk 0.05cvss —epss 0.21

    Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Operations Manager (CUOM) before 8.6 allow remote attackers to inject arbitrary web script or HTML via (1) the extn parameter to iptm/advancedfind.do, (2) the deviceInstanceName parameter to iptm/ddv.do, the…

  • CVE-2010-3274Feb 17, 2011
    Zohocorp
    Manageengine Adselfservice Plus
    risk 0.05cvss —epss 0.21

    Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a (1) showList or…