CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 704 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-40732 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/rear-ports/add/. | ||
| CVE-2024-40731 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/rear-ports/{id}/edit/. | ||
| CVE-2024-40730 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/interfaces/{id}/edit/. | ||
| CVE-2024-40729 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/interfaces/add/. | ||
| CVE-2024-40728 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-server-ports/{id}/edit/. | ||
| CVE-2024-40727 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-server-ports/add/. | ||
| CVE-2024-40726 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-ports/{id}/edit/. | ||
| CVE-2024-38972 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-ports/add/. | ||
| CVE-2024-27183 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | XSS vulnerability in DJ-HelpfulArticles component for Joomla. | ||
| CVE-2024-26279 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | The wrapper extensions do not correctly validate inputs, leading to XSS vectors. | ||
| CVE-2024-26278 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | The Custom Fields component not correctly filter inputs, leading to a XSS vector. | ||
| CVE-2024-21731 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | Improper handling of input could lead to an XSS vector in the StringHelper::truncate method. | ||
| CVE-2024-21729 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field. | ||
| CVE-2024-6334 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. | ||
| CVE-2024-39594 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause low impact on the confidentiality and… | ||
| CVE-2024-37174 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application. | ||
| CVE-2024-37173 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to… | ||
| CVE-2024-34685 | Med | 0.40 | 6.1 | 0.00 | Jul 9, 2024 | Due to weak encoding of user-controlled input in SAP NetWeaver Knowledge Management XMLEditor which allows malicious scripts can be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the… | ||
| CVE-2024-39203 | Med | 0.40 | 6.1 | 0.01 | Jul 8, 2024 | A cross-site scripting (XSS) vulnerability in the Backend Theme Management module of Z-BlogPHP v1.7.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | ||
| CVE-2024-39174 | Med | 0.40 | 6.1 | 0.00 | Jul 5, 2024 | A cross-site scripting (XSS) vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a published article. |
- risk 0.40cvss 6.1epss 0.00
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/rear-ports/add/.
- risk 0.40cvss 6.1epss 0.00
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/rear-ports/{id}/edit/.
- risk 0.40cvss 6.1epss 0.00
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/interfaces/{id}/edit/.
- risk 0.40cvss 6.1epss 0.00
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/interfaces/add/.
- risk 0.40cvss 6.1epss 0.00
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-server-ports/{id}/edit/.
- risk 0.40cvss 6.1epss 0.00
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-server-ports/add/.
- risk 0.40cvss 6.1epss 0.00
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-ports/{id}/edit/.
- risk 0.40cvss 6.1epss 0.00
A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-ports/add/.
- risk 0.40cvss 6.1epss 0.00
XSS vulnerability in DJ-HelpfulArticles component for Joomla.
- risk 0.40cvss 6.1epss 0.00
The wrapper extensions do not correctly validate inputs, leading to XSS vectors.
- risk 0.40cvss 6.1epss 0.00
The Custom Fields component not correctly filter inputs, leading to a XSS vector.
- risk 0.40cvss 6.1epss 0.00
Improper handling of input could lead to an XSS vector in the StringHelper::truncate method.
- risk 0.40cvss 6.1epss 0.00
Inadequate input validation leads to XSS vulnerabilities in the accessiblemedia field.
- risk 0.40cvss 6.1epss 0.00
The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- risk 0.40cvss 6.1epss 0.00
SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause low impact on the confidentiality and…
- risk 0.40cvss 6.1epss 0.00
Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application.
- risk 0.40cvss 6.1epss 0.00
Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to…
- risk 0.40cvss 6.1epss 0.00
Due to weak encoding of user-controlled input in SAP NetWeaver Knowledge Management XMLEditor which allows malicious scripts can be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the…
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in the Backend Theme Management module of Z-BlogPHP v1.7.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- risk 0.40cvss 6.1epss 0.00
A cross-site scripting (XSS) vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a published article.