CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 715 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-31064 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2024 | Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the First Name input field. | ||
| CVE-2024-31061 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2024 | Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Last Name input field. | ||
| CVE-2024-27719 | Med | 0.40 | 6.1 | 0.00 | Mar 28, 2024 | A cross site scripting (XSS) vulnerability in rems FAQ Management System v.1.0 allows a remote attacker to obtain sensitive information via a crafted payload to the Frequently Asked Question field in the Add FAQ function. | ||
| CVE-2024-0673 | Med | 0.40 | 6.1 | 0.00 | Mar 28, 2024 | The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed | ||
| CVE-2024-28852 | Med | 0.40 | 6.1 | 0.01 | Mar 27, 2024 | Ampache is a web based audio/video streaming application and file manager. Ampache has multiple reflective XSS vulnerabilities,this means that all forms in the Ampache that use `rule` as a variable are not secure. For example, when querying a song, when querying a podcast, we… | ||
| CVE-2023-25364 | Med | 0.40 | 6.1 | 0.00 | Mar 27, 2024 | Opswat Metadefender Core before 5.2.1 does not properly defend against potential HTML injection and XSS attacks. | ||
| CVE-2024-29832 | Med | 0.40 | 6.1 | 0.00 | Mar 26, 2024 | The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be… | ||
| CVE-2024-29644 | Med | 0.40 | 6.1 | 0.01 | Mar 26, 2024 | Cross Site Scripting vulnerability in dcat-admin v.2.1.3 and before allows a remote attacker to execute arbitrary code via a crafted script to the user login box. | ||
| CVE-2024-28126 | — | Med | 0.40 | 6.1 | 0.00 | Mar 26, 2024 | Cross-site scripting vulnerability exists in 0ch BBS Script ver.4.00. An arbitrary script may be executed on the web browser of the user accessing the website that uses the product. Note that the developer was unreachable, therefore, users should consider stop using 0ch BBS… | |
| CVE-2024-26018 | Med | 0.40 | 6.1 | 0.00 | Mar 26, 2024 | Cross-site scripting vulnerability exists in TvRock 0.9t8a. An arbitrary script may be executed on the web browser of the user accessing the website that uses the product. Note that the developer was unreachable, therefore, users should consider stop using TvRock 0.9t8a. | ||
| CVE-2024-25175 | Med | 0.40 | 6.1 | 0.00 | Mar 25, 2024 | An issue in Kickdler before v1.107.0 allows attackers to provide an XSS payload via a HTTP response splitting attack. | ||
| CVE-2024-2727 | Med | 0.40 | 6.1 | 0.00 | Mar 22, 2024 | HTML injection vulnerability affecting the CIGESv2 system, which allows an attacker to inject arbitrary code and modify elements of the website and email confirmation message. | ||
| CVE-2024-2726 | Med | 0.40 | 6.1 | 0.00 | Mar 22, 2024 | Stored Cross-Site Scripting (Stored-XSS) vulnerability affecting the CIGESv2 system, allowing an attacker to execute and store malicious javascript code in the application form without prior registration. | ||
| CVE-2024-29273 | Med | 0.40 | 6.1 | 0.00 | Mar 22, 2024 | There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document. | ||
| CVE-2024-25807 | Med | 0.40 | 6.1 | 0.00 | Mar 22, 2024 | Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album. | ||
| CVE-2024-0957 | Med | 0.40 | 6.1 | 0.00 | Mar 22, 2024 | The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Customer Notes field in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping.… | ||
| CVE-2024-29374 | Med | 0.40 | 6.1 | 0.01 | Mar 21, 2024 | A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter. | ||
| CVE-2023-48903 | Med | 0.40 | 6.1 | 0.01 | Mar 21, 2024 | Stored Cross-Site Scripting (XSS) vulnerability in tramyardg autoexpress 1.3.0, allows remote unauthenticated attackers to inject arbitrary web script or HTML within parameter "imgType" via in uploadCarImages.php. | ||
| CVE-2024-27626 | Med | 0.40 | 6.1 | 0.00 | Mar 21, 2024 | A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Dotclear version 2.29. The flaw exists within the Search functionality of the Admin Panel. | ||
| CVE-2024-25167 | Med | 0.40 | 6.1 | 0.01 | Mar 21, 2024 | Cross Site Scripting vulnerability in eblog v1.0 allows a remote attacker to execute arbitrary code via a crafted script to the argument description parameter when submitting a comment on a post. |
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the First Name input field.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Last Name input field.
- risk 0.40cvss 6.1epss 0.00
A cross site scripting (XSS) vulnerability in rems FAQ Management System v.1.0 allows a remote attacker to obtain sensitive information via a crafted payload to the Frequently Asked Question field in the Add FAQ function.
- risk 0.40cvss 6.1epss 0.00
The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- risk 0.40cvss 6.1epss 0.01
Ampache is a web based audio/video streaming application and file manager. Ampache has multiple reflective XSS vulnerabilities,this means that all forms in the Ampache that use `rule` as a variable are not secure. For example, when querying a song, when querying a podcast, we…
- risk 0.40cvss 6.1epss 0.00
Opswat Metadefender Core before 5.2.1 does not properly defend against potential HTML injection and XSS attacks.
- risk 0.40cvss 6.1epss 0.00
The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be…
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting vulnerability in dcat-admin v.2.1.3 and before allows a remote attacker to execute arbitrary code via a crafted script to the user login box.
- risk 0.40cvss 6.1epss 0.00
Cross-site scripting vulnerability exists in 0ch BBS Script ver.4.00. An arbitrary script may be executed on the web browser of the user accessing the website that uses the product. Note that the developer was unreachable, therefore, users should consider stop using 0ch BBS…
- risk 0.40cvss 6.1epss 0.00
Cross-site scripting vulnerability exists in TvRock 0.9t8a. An arbitrary script may be executed on the web browser of the user accessing the website that uses the product. Note that the developer was unreachable, therefore, users should consider stop using TvRock 0.9t8a.
- risk 0.40cvss 6.1epss 0.00
An issue in Kickdler before v1.107.0 allows attackers to provide an XSS payload via a HTTP response splitting attack.
- risk 0.40cvss 6.1epss 0.00
HTML injection vulnerability affecting the CIGESv2 system, which allows an attacker to inject arbitrary code and modify elements of the website and email confirmation message.
- risk 0.40cvss 6.1epss 0.00
Stored Cross-Site Scripting (Stored-XSS) vulnerability affecting the CIGESv2 system, allowing an attacker to execute and store malicious javascript code in the application form without prior registration.
- risk 0.40cvss 6.1epss 0.00
There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document.
- risk 0.40cvss 6.1epss 0.00
Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album.
- risk 0.40cvss 6.1epss 0.00
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Customer Notes field in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping.…
- risk 0.40cvss 6.1epss 0.01
A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.
- risk 0.40cvss 6.1epss 0.01
Stored Cross-Site Scripting (XSS) vulnerability in tramyardg autoexpress 1.3.0, allows remote unauthenticated attackers to inject arbitrary web script or HTML within parameter "imgType" via in uploadCarImages.php.
- risk 0.40cvss 6.1epss 0.00
A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Dotclear version 2.29. The flaw exists within the Search functionality of the Admin Panel.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting vulnerability in eblog v1.0 allows a remote attacker to execute arbitrary code via a crafted script to the argument description parameter when submitting a comment on a post.