VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,561)

page 304 of 2,429
  • CVE-2022-35155MedSep 30, 2022
    Phpgurukul
    Bus Pass Management System
    risk 0.43cvss 6.1epss 0.03

    Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the searchdata parameter.

  • CVE-2022-3062MedSep 26, 2022
    WordPress
    Simple File List
    risk 0.43cvss 6.1epss 0.44

    The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting

  • CVE-2022-28598MedAug 22, 2022
    Frappe
    Erpnext
    risk 0.43cvss 6.1epss 0.04

    Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users.

  • CVE-2022-34048MedJul 20, 2022
    Wavlink
    WN533A8
    risk 0.43cvss 6.1epss 0.07

    Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login_page parameter.

  • CVE-2022-29296MedJun 6, 2022
    Avantune
    Genialcloud Proj
    risk 0.43cvss 6.1epss 0.02

    A reflected cross-site scripting (XSS) vulnerability in the login portal of Avantune Genialcloud ProJ - 10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

  • CVE-2021-27781MedMay 27, 2022
    HCLTech
    Bigfix Mobile
    risk 0.43cvss 6.6epss 0.00

    The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.

  • CVE-2022-28818MedMay 12, 2022
    Adobe Inc.
    Coldfusion
    risk 0.43cvss 6.1epss 0.45

    ColdFusion versions CF2021U3 (and earlier) and CF2018U13 are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the…

  • CVE-2021-31674MedMay 2, 2022
    Cyclos
    Cyclos
    risk 0.43cvss 6.1epss 0.04

    Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascript code via undefine enum constant.

  • CVE-2021-31673MedMay 2, 2022
    Cyclos
    Cyclos
    risk 0.43cvss 6.1epss 0.03

    A Dom-based Cross-site scripting (XSS) vulnerability at registration account in Cyclos 4 PRO.14.7 and before allows remote attackers to inject arbitrary web script or HTML via the groupId parameter.

  • CVE-2021-43009MedApr 8, 2022
    OpServices
    OpMon
    risk 0.43cvss 6.1epss 0.02

    A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the request URL.

  • CVE-2022-24181MedApr 1, 2022
    Pkp
    Open Journal Systems
    risk 0.43cvss 6.1epss 0.06

    Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header.

  • CVE-2021-20323MedMar 25, 2022
    Red Hat
    Keycloak
    risk 0.43cvss 6.1epss 0.37

    A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.

  • CVE-2022-26263MedMar 25, 2022
    Yonyou
    U8\+
    risk 0.43cvss 6.1epss 0.42

    Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp.

  • CVE-2022-22791MedJan 28, 2022
    Synel
    Eharmony
    risk 0.43cvss 6.6epss 0.00

    SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system.

  • CVE-2021-45425MedDec 28, 2021
    SAFARI Montage
    SAFARI Montage
    risk 0.43cvss 6.1epss 0.03

    Reflected Cross Site Scripting (XSS) in SAFARI Montage versions 8.3 and 8.5 allows remote attackers to execute JavaScript codes.

  • CVE-2021-31558MedDec 22, 2021
    Deltaww
    Diaenergie
    risk 0.43cvss 6.5epss 0.11

    DIAEnergie Version 1.7.5 and prior is vulnerable to stored cross-site scripting when an unauthenticated user injects arbitrary code into the parameter “descr” of the script “DIAE_hierarchyHandler.ashx”.

  • CVE-2021-44916MedDec 20, 2021
    Opmantek
    Open-AudIT Community
    risk 0.43cvss 6.1epss 0.04

    Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. If a bad value is passed to the routine via a URL, malicious JavaScript code can be executed in the victim's browser.

  • CVE-2021-41183MedOct 26, 2021
    jQuery
    jQuery
    risk 0.43cvss 6.5epss 0.09

    jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various…

  • CVE-2021-31682MedOct 22, 2021
    Automated Logic
    WebCTRL
    risk 0.43cvss 6.1epss 0.11

    The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a…

  • CVE-2021-35323MedOct 19, 2021
    Bludit
    Bludit
    risk 0.43cvss 6.1epss 0.05

    Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login.