CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,561)
page 305 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-42566 | Med | 0.43 | 6.1 | 0.06 | Oct 18, 2021 | myfactory.FMS before 7.1-912 allows XSS via the Error parameter. | ||
| CVE-2021-42565 | Med | 0.43 | 6.1 | 0.06 | Oct 18, 2021 | myfactory.FMS before 7.1-912 allows XSS via the UID parameter. | ||
| CVE-2018-16061 | Med | 0.43 | 6.1 | 0.04 | Oct 15, 2021 | Mitsubishi Electric Europe B.V. SmartRTU devices allow XSS via the username parameter or PATH_INFO to login.php. | ||
| CVE-2021-24719 | Med | 0.43 | 6.1 | 0.03 | Oct 11, 2021 | The Enfold Enfold WordPress theme before 4.8.4 was vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability is present on Enfold versions previous than 4.8.4 which use Avia Page Builder. | ||
| CVE-2021-41878 | Med | 0.43 | 6.1 | 0.10 | Oct 4, 2021 | A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console and it is possible to insert a vulnerable malicious button. | ||
| CVE-2021-41318 | Med | 0.43 | 6.1 | 0.06 | Sep 28, 2021 | In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input. which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser. | ||
| CVE-2021-36823 | Med | 0.43 | 6.6 | 0.01 | Sep 23, 2021 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cusmin AGCA - Absolutely Glamorous Custom Admin (WordPress plugin) allows Stored XSS.This issue affects AGCA - Absolutely Glamorous Custom Admin (WordPress plugin): from n/a… | ||
| CVE-2021-40868 | Med | 0.43 | 6.1 | 0.09 | Sep 21, 2021 | In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS. | ||
| CVE-2021-38156 | Med | 0.43 | 5.4 | 0.93 | Sep 15, 2021 | In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard. | ||
| CVE-2021-39201 | Hig | 0.43 | 7.6 | 0.01 | Sep 9, 2021 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions… | ||
| CVE-2019-25046 | Med | 0.43 | 6.1 | 0.02 | Jun 10, 2021 | The Web Client in Cerberus FTP Server Enterprise before 10.0.19 and 11.x before 11.0.4 allows XSS via an SVG document. | ||
| CVE-2021-34370 | Med | 0.43 | 6.1 | 0.10 | Jun 9, 2021 | Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS. NOTE: the vendor states "there are configurable security flags and we are unable to reproduce them with the available information. | ||
| CVE-2021-26078 | Med | 0.43 | 6.1 | 0.04 | Jun 7, 2021 | The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… | ||
| CVE-2021-33904 | Med | 0.43 | 6.1 | 0.10 | Jun 7, 2021 | In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. NOTE: The vendor states "there are configurable security flags and we are unable to reproduce them with the available information. | ||
| CVE-2021-24300 | Med | 0.43 | 6.1 | 0.11 | May 24, 2021 | The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue | ||
| CVE-2021-29625 | Hig | 0.43 | 7.5 | 0.10 | May 19, 2021 | Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer… | ||
| CVE-2021-24299 | Med | 0.43 | 6.1 | 0.06 | May 17, 2021 | The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to… | ||
| CVE-2021-24287 | Med | 0.43 | 6.1 | 0.10 | May 14, 2021 | The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue | ||
| CVE-2021-24245 | Med | 0.43 | 6.1 | 0.06 | May 6, 2021 | The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue. | ||
| CVE-2021-25680 | Med | 0.43 | 6.1 | 0.02 | Apr 20, 2021 | The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed. Only version… |
- risk 0.43cvss 6.1epss 0.06
myfactory.FMS before 7.1-912 allows XSS via the Error parameter.
- risk 0.43cvss 6.1epss 0.06
myfactory.FMS before 7.1-912 allows XSS via the UID parameter.
- risk 0.43cvss 6.1epss 0.04
Mitsubishi Electric Europe B.V. SmartRTU devices allow XSS via the username parameter or PATH_INFO to login.php.
- risk 0.43cvss 6.1epss 0.03
The Enfold Enfold WordPress theme before 4.8.4 was vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability is present on Enfold versions previous than 4.8.4 which use Avia Page Builder.
- risk 0.43cvss 6.1epss 0.10
A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console and it is possible to insert a vulnerable malicious button.
- risk 0.43cvss 6.1epss 0.06
In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input. which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser.
- risk 0.43cvss 6.6epss 0.01
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cusmin AGCA - Absolutely Glamorous Custom Admin (WordPress plugin) allows Stored XSS.This issue affects AGCA - Absolutely Glamorous Custom Admin (WordPress plugin): from n/a…
- risk 0.43cvss 6.1epss 0.09
In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.
- risk 0.43cvss 5.4epss 0.93
In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.
- risk 0.43cvss 7.6epss 0.01
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions…
- risk 0.43cvss 6.1epss 0.02
The Web Client in Cerberus FTP Server Enterprise before 10.0.19 and 11.x before 11.0.4 allows XSS via an SVG document.
- risk 0.43cvss 6.1epss 0.10
Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS. NOTE: the vendor states "there are configurable security flags and we are unable to reproduce them with the available information.
- risk 0.43cvss 6.1epss 0.04
The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via a cross site scripting (XSS)…
- risk 0.43cvss 6.1epss 0.10
In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. NOTE: The vendor states "there are configurable security flags and we are unable to reproduce them with the available information.
- risk 0.43cvss 6.1epss 0.11
The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue
- risk 0.43cvss 7.5epss 0.10
Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer…
- risk 0.43cvss 6.1epss 0.06
The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to…
- risk 0.43cvss 6.1epss 0.10
The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue
- risk 0.43cvss 6.1epss 0.06
The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue.
- risk 0.43cvss 6.1epss 0.02
The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed. Only version…