VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,541)

page 2124 of 2,428
  • CVE-2007-5427Oct 12, 2007
    Joomla
    Joomla!
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the com_search component in Joomla! 1.0.13 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchword parameter. NOTE: this might be related to CVE-2007-4189.1.

  • CVE-2007-5429Oct 12, 2007
    Nucleus
    Nucleus
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Nucleus 3.01 allows remote attackers to inject arbitrary web script or HTML via the archive parameter.

  • CVE-2007-5426Oct 12, 2007
    Interspire
    Activekb
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in ActiveKB NX 2.5.4 allow remote attackers to inject arbitrary web script or HTML via the page parameter to the default URI for some directories, as demonstrated by (1) ActiveKB/ and (2) default/categories/ActiveKB/.

  • CVE-2007-5428Oct 12, 2007
    Umi CMS
    Umi.CMS
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in UMI CMS allows remote attackers to inject arbitrary web script or HTML via the search_string parameter to the default URI in search_do/.

  • CVE-2007-5411Oct 12, 2007
    Linksys
    Spa941
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Linksys SPA941 VoIP Phone with firmware 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the From header in a SIP message.

  • CVE-2007-5386Oct 12, 2007
    PhpMyAdmin
    phpMyAdmin
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in scripts/setup.php in phpMyAdmin 2.11.1, when accessed by a browser that does not URL-encode requests, allows remote attackers to inject arbitrary web script or HTML via the query string.

  • CVE-2007-5370Oct 11, 2007
    Netwin
    Dnewsweb
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/dnewsweb.exe in NetWin DNewsWeb (DNews News Server) 57e1 allow remote attackers to inject arbitrary web script or HTML via the (1) group or (2) utag parameter.

  • CVE-2007-5312Oct 9, 2007
    Torrenttrader
    Torrenttrader
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in TorrentTrader Classic 1.07 allows remote attackers to inject arbitrary web script or HTML via the (1) color parameter to pjirc/css.php and the (2) cat parameter to browse.php.

  • CVE-2007-5304Oct 9, 2007
    ELSEIF
    CMS
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) repertimage parameter to utilisateurs/vousetesbannis.php, the (2) elseifvotetxtresultatduvote parameter to…

  • CVE-2007-5293Oct 9, 2007
    Idmos
    Idmos
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in IDMOS 1.0-beta (aka Phoenix) allow remote attackers to inject arbitrary web script or HTML via the (1) err_msg parameter to error.php and the (2) content parameter to templates/simple/ia.php.

  • CVE-2007-5290Oct 9, 2007
    MailBee
    WebMail Lite ASP
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail Pro ASP before 3.4.64, WebMail Lite ASP before 4.0.11, and WebMail Lite PHP before 4.0.22; allow remote attackers to inject arbitrary web script or HTML via…

  • CVE-2007-5255Oct 6, 2007
    Google
    Mini Search Appliance
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Google Mini Search Appliance 3.4.14 allows remote attackers to inject arbitrary web script or HTML via the ie parameter to the /search URI.

  • CVE-2007-5235Oct 6, 2007
    Uebimiau
    Uebimiau
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in index.php in Uebimiau 2.7.2 through 2.7.10 allows remote attackers to inject arbitrary web script or HTML via the f_email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party…

  • CVE-2007-5218Oct 5, 2007
    Don Barnes
    Drbguestbook
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in Don Barnes DRBGuestbook 1.1.13 allows remote attackers to inject arbitrary web script or HTML via the action parameter.

  • CVE-2007-5142Sep 28, 2007
    Solidweb
    Novus
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in buscar.asp in Solidweb Novus 1.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  • CVE-2007-5127Sep 27, 2007
    Simpgb
    Simpgb
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in SimpGB 1.46.02 allow remote attackers to inject arbitrary web script or HTML via (1) the l_username parameter to the default URI under admin/ or (2) the l_emoticonlist parameter to admin/emoticonlist.php.

  • CVE-2007-5120Sep 27, 2007
    Jspwiki
    Jspwiki
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in JSPWiki 2.4.103 and 2.5.139-beta allow remote attackers to inject arbitrary web script or HTML via the (1) group and (2) members parameters in (a) NewGroup.jsp; the (3) edittime parameter in (b) Edit.jsp; the (4) edittime,…

  • CVE-2007-5112Sep 26, 2007
    Google
    Urchin
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in session.cgi (aka the login page) in Google Urchin 5 5.7.03 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, a different vulnerability than CVE-2007-4713. NOTE: this can be leveraged to…

  • CVE-2007-4874Sep 26, 2007
    Boesch It
    Simpnews
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in SimpNews 2.41.03 allow remote attackers to inject arbitrary web script or HTML via the (1) l_username parameter to admin/layout2b.php, and the (2) backurl parameter to comment.php.

  • CVE-2007-5052Sep 24, 2007
    Martin Unzner
    Vigile CMS
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in Vigile CMS 1.8 allow remote attackers to inject arbitrary web script or HTML via a request to the wiki module with (1) the title parameter or (2) a "title=" sequence in the PATH_INFO, or a request to the…