VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (22,695)

page 662 of 1,135
  • CVE-2012-1892Sep 11, 2012
    Microsoft
    Visual Studio Team Foundation Server
    risk 0.04cvss —epss 0.45

    Cross-site scripting (XSS) vulnerability in Microsoft Visual Studio Team Foundation Server 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "XSS Vulnerability."

  • CVE-2012-1912Sep 9, 2012
    Php Address
    PHP Address
    risk 0.04cvss —epss 0.11

    Cross-site scripting (XSS) vulnerability in preferences.php in PHP Address Book 7.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the from parameter. NOTE: the index.php vector is already covered by CVE-2008-2566.

  • CVE-2012-1110Sep 6, 2012
    Datemill
    Etano
    risk 0.04cvss —epss 0.12

    Multiple cross-site scripting (XSS) vulnerabilities in Etano 1.22 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user, (2) email, (3) email2, (4) f17_zip, or (5) agree parameter to join.php; (6) PATH_INFO, (7) st, (8) f17_city, (9)…

  • CVE-2012-4870Sep 6, 2012
    Freepbx
    Freepbx
    risk 0.04cvss —epss 0.12

    Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) context parameter to panel/index_amp.php or (2) panel/dhtml/index.php; (3) clid or (4) clidname parameters to…

  • CVE-2012-2741Sep 6, 2012
    Phplist
    Phplist
    risk 0.04cvss —epss 0.13

    Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a reconcileusers action.

  • CVE-2012-4679Aug 27, 2012
    Sourcefabric
    Newscoop
    risk 0.04cvss —epss 0.11

    Cross-site scripting (XSS) vulnerability in admin/login.php in Newscoop before 3.5.5 allows remote attackers to inject arbitrary web script or HTML via the f_user_name parameter.

  • CVE-2012-1935Aug 27, 2012
    Sourcefabric
    Newscoop
    risk 0.04cvss —epss 0.07

    Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4.x before 4 RC4 allow remote attackers to inject arbitrary web script or HTML via the (1) Back parameter to admin/ad.php, or the (2) token or (3) f_email parameter to…

  • CVE-2012-4344Aug 15, 2012
    Progress (organisation)
    Whatsup Gold
    risk 0.04cvss —epss 0.08

    Cross-site scripting (XSS) vulnerability in Ipswitch WhatsUp Gold 15.02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the SNMP system name of the attacking host.

  • CVE-2012-4278Aug 13, 2012
    Free Realty
    Free Realty
    risk 0.04cvss —epss 0.07

    Multiple cross-site scripting (XSS) vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) notes parameter to (a) admin/agenteditor.php; (2) title, (3) previewdesc, (4) fulldesc, or (5) notes parameter (b) to…

  • CVE-2012-4266Aug 13, 2012
    Itechscripts
    Proman Xpress
    risk 0.04cvss —epss 0.07

    Cross-site scripting (XSS) vulnerability in client_details.php in Proman Xpress 5.0.1 allows remote attackers to inject arbitrary web script or HTML via the cl_comments parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2012-4262Aug 13, 2012
    Hccgmbh
    Mycare2x
    risk 0.04cvss —epss 0.09

    Multiple cross-site scripting (XSS) vulnerabilities in myCare2x allow remote attackers to inject arbitrary web script or HTML via the (1) name_last, (2) name_first, (3) name_middle, or (4) name_maiden parameter to modules/patient/mycare_pid.php; (5) favorites or (6) lang…

  • CVE-2012-4259Aug 13, 2012
    risk 0.04cvss —epss 0.10

    Cross-site scripting (XSS) vulnerability in the contacts in (1) XPhone UC Web and the (2) web frontend for XPhone Virtual Directory in C4B XPhone Unified Communications (UC) 2011 Web 4.1.890S R1 allows remote attackers to inject arbitrary web script or HTML via the company name.…

  • CVE-2012-4251Aug 13, 2012
    Mysqldumper
    Mysqldumper
    risk 0.04cvss —epss 0.08

    Multiple cross-site scripting (XSS) vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter to index.php, (2) phase parameter to install.php, (3) tablename or (4) dbid parameter to sql.php, or (5) filename…

  • CVE-2012-4246Aug 12, 2012
    Phplist
    Phplist
    risk 0.04cvss —epss 0.07

    Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter; or the (2) footer, (3) status, or (4) testtarget parameter in the send page.

  • CVE-2012-3952Aug 12, 2012
    Phplist
    Phplist
    risk 0.04cvss —epss 0.10

    Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page.

  • CVE-2012-2698Jun 29, 2012
    MediaWiki
    Mediawiki
    risk 0.04cvss —epss 0.15

    Cross-site scripting (XSS) vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to…

  • CVE-2012-2172Jun 22, 2012
    IBM
    Ds Storage Manager Host Software
    risk 0.04cvss —epss 0.14

    Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Series devices allows remote attackers to inject arbitrary web script or HTML via the updateRegn parameter.

  • CVE-2012-2906May 21, 2012
    Artiphp
    Artiphp CMS
    risk 0.04cvss —epss 0.12

    Multiple cross-site scripting (XSS) vulnerabilities in artpublic/recommandation/index.php in Artiphp CMS 5.5.0 Neo (r422) allow remote attackers to inject arbitrary web script or HTML via the (1) add_img_name_post, (2) asciiart_post, (3) expediteur, (4) titre_sav, or (5)…

  • CVE-2012-0873Feb 23, 2012
    Boonex
    Dolphin
    risk 0.04cvss —epss 0.07

    Multiple cross-site scripting (XSS) vulnerabilities in Boonex Dolphin before 7.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) explain parameter to explanation.php or the (2) photos_only, (3) online_only, or (4) mode parameters to viewFriends.php.

  • CVE-2012-1059Feb 14, 2012
    OsCommerce
    Online Merchant
    risk 0.04cvss —epss 0.07

    Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Cart/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the value_title parameter, as demonstrated using the "Front" field in…