VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,541)

page 2094 of 2,428
  • CVE-2008-7184Sep 8, 2009
    Diigo
    Diigo Toolbar
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Diigo Toolbar and Diigolet allows remote attackers to inject arbitrary web script or HTML via a public comment.

  • CVE-2008-7171Sep 8, 2009
    Lightweight news portal (LNP)
    Lightweight news portal (LNP)
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Lightweight news portal (LNP) 1.0b allow remote attackers to inject arbitrary web script or HTML via the (1) photo parameter to show_photo.php, (2) potd parameter to show_potd.php, or (3) the Current question field in a vote…

  • CVE-2009-3066Sep 3, 2009
    Propertywatchscript
    Property Watch
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in PropertyWatchScript.com Property Watch 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) videoid parameter to tools/email.php and (2) redirect parameter to tools/login.php.

  • CVE-2009-3057Sep 3, 2009
    Aom Software
    Beex
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in AOM Software Beex 3 allow remote attackers to inject arbitrary web script or HTML via the navaction parameter to (1) news.php and (2) partneralle.php.

  • CVE-2008-7141Sep 1, 2009
    @lex
    Poll
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in setup.php in @lex Poll 2.1 allows remote attackers to inject arbitrary web script or HTML via the language_setup parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2008-7140Sep 1, 2009
    @lex
    @lex Guestbook
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in @lex Guestbook 4.0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) language_setup parameter to setup.php or (2) test parameter to index.php. NOTE: the provenance of this information…

  • CVE-2008-7134Sep 1, 2009
    Redgalaxy
    Download Center
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the default URI in Chris LaPointe RedGalaxy Download Center 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file parameter, (2) message parameter in a login action, (3) category parameter in a…

  • CVE-2008-7133Sep 1, 2009
    Onlinetools.org
    Easyimagecatalogue
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in onlinetools.org EasyImageCatalogue 1.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) search and (2) d index.php parameters to index.php, (3) dir parameter to thumber.php, and the d parameter to…

  • CVE-2008-7098Aug 27, 2009
    Qsoft Inc
    K-Rate Premium
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Qsoft K-Rate Premium allow remote attackers to inject arbitrary web script or HTML via the blog, possibly the (1) Title and (2) Text fields; (3) the gallery, possibly the Description field in Your Pictures; (4) the forum,…

  • CVE-2008-7089Aug 26, 2009
    Pligg
    CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Pligg 9.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in a search action to user.php and other unspecified vectors.

  • CVE-2009-2965Aug 25, 2009
    Radvision
    Scopia
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in entry/index.jsp in Radvision Scopia 5.7, and possibly other versions before SD 7.0.100, allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2008-7072Aug 25, 2009
    Chipmunk Scripts
    Topsites
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Chipmunk Topsites allows remote attackers to inject arbitrary web script or HTML via the start parameter.

  • CVE-2008-7057Aug 24, 2009
    BandSite
    CMS
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in merchandise.php in BandSite CMS 1.1.4 allows remote attackers to inject arbitrary HTML or web script via the type parameter.

  • CVE-2008-7043Aug 24, 2009
    Freshscripts
    Fresh Email Script
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in register.php in FreshScripts Fresh Email Script 1.0 through 1.11 allows remote attackers to inject arbitrary web script or HTML via the Email parameter. NOTE: this can be leveraged to modify cookies and conduct session fixation…

  • CVE-2008-7036Aug 24, 2009
    Bcoos
    Bcoos
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in DevTracker module 3.0 for bcoos 1.1.11 and earlier, and DevTracker module 0.20 for E-XooPS 1.0.8 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) direction and (2) order_by…

  • CVE-2009-2930Aug 21, 2009
    elka
    elka CMS
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Search feature in elka CMS (aka Elkapax) allows remote attackers to inject arbitrary web script or HTML via the q parameter to the default URI.

  • CVE-2009-2928Aug 21, 2009
    TGS Content Management
    TGS Content Management
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in login.php in TGS Content Management 0.x allows remote attackers to inject arbitrary web script or HTML via the previous_page parameter, a different vector than CVE-2008-6839.

  • CVE-2008-7017Aug 21, 2009
    Cacert
    Cacert
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in analyse.php in CAcert 20080921, and possibly other versions before 20080928, allows remote attackers to inject arbitrary web script or HTML via the CN (CommonName) field in the subject of an X.509 certificate.

  • CVE-2009-2920Aug 21, 2009
    Elvinbts
    Elvin
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Elvin 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) component and (2) priority parameters to buglist.php; and the (3) Username (4) E-mail, (5) Pass, and (6) Confirm pass fields to…

  • CVE-2009-2893Aug 20, 2009
    Xzero Scripts
    Community Classifieds
    risk 0.03cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in XZero Community Classifieds 4.97.8 allow remote attackers to inject arbitrary web script or HTML via (1) the postevent parameter in a post action or (2) the _xzcal_y parameter.