CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,541)
page 2184 of 2,428| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-5793 | Low | 0.00 | 3.5 | 0.00 | Oct 26, 2023 | A vulnerability was found in flusity CMS and classified as problematic. This issue affects the function loadCustomBlocCreateForm of the file /core/tools/customblock.php of the component Dashboard. The manipulation of the argument customblock_place leads to cross site scripting.… | ||
| CVE-2023-34447 | Hig | 0.00 | 8.8 | 0.01 | Oct 25, 2023 | iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, on `pages/UI.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0. | ||
| CVE-2023-34446 | Hig | 0.00 | 8.8 | 0.01 | Oct 25, 2023 | iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, when displaying `pages/preferences.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0. | ||
| CVE-2023-46287 | Med | 0.00 | 6.1 | 0.01 | Oct 20, 2023 | XSS exists in NagVis before 1.9.38 via the select function in share/server/core/functions/html.php. | ||
| CVE-2023-45958 | Med | 0.00 | 6.1 | 0.00 | Oct 18, 2023 | Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a… | ||
| CVE-2023-43658 | Hig | 0.00 | 8.0 | 0.01 | Oct 16, 2023 | dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Improper escaping of event titles could lead to Cross-site Scripting (XSS) within the 'email preview' UI when a site has CSP… | ||
| CVE-2023-4517 | Med | 0.00 | 5.4 | 0.00 | Oct 13, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6. | ||
| CVE-2023-5556 | Med | 0.00 | 6.1 | 0.01 | Oct 12, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194. | ||
| CVE-2023-5555 | Med | 0.00 | 6.1 | 0.01 | Oct 12, 2023 | Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4. | ||
| CVE-2023-44393 | Cri | 0.00 | 9.3 | 0.01 | Oct 9, 2023 | Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page. This vulnerability can be exploited by an attacker to inject… | ||
| CVE-2023-5351 | Med | 0.00 | 5.4 | 0.01 | Oct 3, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm prior to 7.14.1. | ||
| CVE-2023-43657 | Hig | 0.00 | 7.2 | 0.01 | Sep 28, 2023 | discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting (XSS) issue when a site has content security policy (CSP) headers disabled. Having CSP disabled is a… | ||
| CVE-2023-44276 | Med | 0.00 | 5.4 | 0.01 | Sep 28, 2023 | OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard. | ||
| CVE-2023-44275 | Med | 0.00 | 5.4 | 0.01 | Sep 28, 2023 | OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard. | ||
| CVE-2023-5084 | Low | 0.00 | 3.9 | 0.00 | Sep 20, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8. | ||
| CVE-2023-42452 | Med | 0.00 | 6.1 | 0.00 | Sep 19, 2023 | Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-rc2, under certain conditions, attackers can abuse the translation feature to bypass the server-side HTML sanitization, allowing… | ||
| CVE-2023-39612 | Cri | 0.00 | 9.0 | 0.01 | Sep 16, 2023 | A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interaction with a crafted HTML file or URL. | ||
| CVE-2023-4879 | Med | 0.00 | 4.8 | 0.00 | Sep 10, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1.-git. | ||
| CVE-2023-41316 | Med | 0.00 | 5.5 | 0.00 | Sep 7, 2023 | Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected code to the victims. Registered users can inject HTML into unsanitized emails from the Tolgee instance to other users. This unsanitized HTML… | ||
| CVE-2023-4655 | Med | 0.00 | 6.1 | 0.00 | Aug 31, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1. |
- risk 0.00cvss 3.5epss 0.00
A vulnerability was found in flusity CMS and classified as problematic. This issue affects the function loadCustomBlocCreateForm of the file /core/tools/customblock.php of the component Dashboard. The manipulation of the argument customblock_place leads to cross site scripting.…
- risk 0.00cvss 8.8epss 0.01
iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, on `pages/UI.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.
- risk 0.00cvss 8.8epss 0.01
iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, when displaying `pages/preferences.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.
- risk 0.00cvss 6.1epss 0.01
XSS exists in NagVis before 1.9.38 via the select function in share/server/core/functions/html.php.
- risk 0.00cvss 6.1epss 0.00
Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a…
- risk 0.00cvss 8.0epss 0.01
dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Improper escaping of event titles could lead to Cross-site Scripting (XSS) within the 'email preview' UI when a site has CSP…
- risk 0.00cvss 5.4epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.
- risk 0.00cvss 6.1epss 0.01
Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194.
- risk 0.00cvss 6.1epss 0.01
Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4.
- risk 0.00cvss 9.3epss 0.01
Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page. This vulnerability can be exploited by an attacker to inject…
- risk 0.00cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm prior to 7.14.1.
- risk 0.00cvss 7.2epss 0.01
discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting (XSS) issue when a site has content security policy (CSP) headers disabled. Having CSP disabled is a…
- risk 0.00cvss 5.4epss 0.01
OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard.
- risk 0.00cvss 5.4epss 0.01
OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard.
- risk 0.00cvss 3.9epss 0.00
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8.
- risk 0.00cvss 6.1epss 0.00
Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-rc2, under certain conditions, attackers can abuse the translation feature to bypass the server-side HTML sanitization, allowing…
- risk 0.00cvss 9.0epss 0.01
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interaction with a crafted HTML file or URL.
- risk 0.00cvss 4.8epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1.-git.
- risk 0.00cvss 5.5epss 0.00
Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected code to the victims. Registered users can inject HTML into unsanitized emails from the Tolgee instance to other users. This unsanitized HTML…
- risk 0.00cvss 6.1epss 0.00
Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1.