VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (22,695)

page 657 of 1,135
  • CVE-2008-4918Nov 4, 2008
    SonicWall
    Sonicos Enhanced
    risk 0.05cvss —epss 0.26

    Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1, as used in SonicWALL Pro 2040 and TZ 180 and 190, allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is blocked based on content…

  • CVE-2008-2939Aug 6, 2008
    Apache
    HTTP Server
    risk 0.05cvss —epss 0.65

    Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a…

  • CVE-2008-1888Apr 18, 2008
    Microsoft
    Sharepoint Server
    risk 0.05cvss —epss 0.25

    Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 2.0 allows remote attackers to inject arbitrary web script or HTML via the Picture Source (aka picture object source) field in the Rich Text Editor.

  • CVE-2007-3033Aug 14, 2007
    Microsoft
    Windows Vista
    risk 0.05cvss —epss 0.59

    Cross-site scripting (XSS) vulnerability in Windows Vista Feed Headlines Gadget (aka Sidebar RSS Feeds Gadget) in Windows Vista allows user-assisted remote attackers to execute arbitrary code via an RSS feed with crafted HTML attributes, which are not properly removed and are…

  • CVE-2006-2016Apr 25, 2006
    Debian
    Debian Linux
    risk 0.05cvss —epss 0.22

    Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dn parameter in (a) compare_form.php, (b) copy_form.php, (c) rename_form.php, (d) template_engine.php, and (e)…

  • CVE-2024-27136Jun 24, 2024
    Jspwiki
    Jspwiki
    risk 0.04cvss —epss 0.51

    XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later.

  • CVE-2022-31097Jul 15, 2022
    Grafana
    Grafana
    risk 0.04cvss —epss 0.48

    Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability…

  • CVE-2019-3810Mar 25, 2019
    Moodle
    Moodle
    risk 0.04cvss —epss 0.08

    A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by…

  • CVE-2015-5529Jul 16, 2015
    Freereprintables
    Articlefr
    risk 0.04cvss —epss 0.07

    Multiple cross-site scripting (XSS) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter to dashboard/settings/categories/, (2) title or (3) rel parameter to dashboard/settings/links/, or…

  • CVE-2015-5520Jul 14, 2015
    Orchardproject
    Orchard
    risk 0.04cvss —epss 0.16

    Cross-site scripting (XSS) vulnerability in the Users module in Orchard 1.7.3 through 1.8.2 and 1.9.x before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the username when creating a new user account, which is not properly handled when deleting an…

  • CVE-2015-5066Jun 24, 2015
    Metalgenix
    Genixcms
    risk 0.04cvss —epss 0.08

    Multiple cross-site scripting (XSS) vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) content or (2) title field in an add action in the posts page to index.php or the (3) q parameter in the posts page to…

  • CVE-2015-1389May 28, 2015
    Arubanetworks
    Clearpass Policy Manager
    risk 0.04cvss —epss 0.12

    Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote attackers to inject arbitrary web script or HTML via the username parameter to tips/tipsLoginSubmit.action.

  • CVE-2015-2678Mar 23, 2015
    Genixcms
    Genixcms
    risk 0.04cvss —epss 0.15

    Multiple cross-site scripting (XSS) vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter in the categories page to gxadmin/index.php or (2) page parameter to index.php.

  • CVE-2015-2315Mar 17, 2015
    Wpml
    Wpml
    risk 0.04cvss —epss 0.08

    Cross-site scripting (XSS) vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the target parameter in a reminder_popup action to the default URI.

  • CVE-2015-2275Mar 12, 2015
    Woltlab
    Community Gallery
    risk 0.04cvss —epss 0.14

    Cross-site scripting (XSS) vulnerability in WoltLab Community Gallery 2.0 before 2014-12-26 allows remote attackers to inject arbitrary web script or HTML via the parameters[data][7][title] parameter in a saveImageData action to index.php/AJAXProxy.

  • CVE-2015-2182Mar 11, 2015
    AJ Square
    Zeuscart
    risk 0.04cvss —epss 0.11

    Multiple cross-site scripting (XSS) vulnerabilities in ZeusCart 4 allow remote attackers to inject arbitrary web script or HTML via the (1) schltr parameter in a brands action or (2) brand parameter in a viewbrands action to index.php. NOTE: The search parameter vector is…

  • CVE-2010-5322Mar 11, 2015
    AJ Square
    Zeuscart
    risk 0.04cvss —epss 0.08

    Cross-site scripting (XSS) vulnerability in ZeusCart 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in a search action to index.php.

  • CVE-2015-2218Mar 5, 2015
    Magic Hills
    Wonderplugin Audio Player
    risk 0.04cvss —epss 0.13

    Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) item[name] or (2)…

  • CVE-2014-8690Feb 19, 2015
    Exponent
    Exponent CMS
    risk 0.04cvss —epss 0.15

    Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, the (2) src parameter in a none action to…

  • CVE-2015-1422Jan 29, 2015
    Siteserver
    CMS
    risk 0.04cvss —epss 0.17

    Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) horder[], (2) jak_catid, (3) jak_content, (4) jak_css, (5) jak_delete_log[], (6) jak_email, (7) jak_extfile, (8) jak_file, (9)…