CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 727 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-49469 | Med | 0.40 | 6.1 | 0.01 | Dec 28, 2023 | Reflected Cross Site Scripting (XSS) vulnerability in Shaarli v0.12.2, allows remote attackers to execute arbitrary code via search tag function. | ||
| CVE-2023-6268 | Med | 0.40 | 6.1 | 0.00 | Dec 26, 2023 | The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | ||
| CVE-2023-6166 | Med | 0.40 | 6.1 | 0.00 | Dec 26, 2023 | The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting | ||
| CVE-2023-38826 | Med | 0.40 | 6.1 | 0.00 | Dec 25, 2023 | A Cross Site Scripting (XSS) vulnerability exists in Follet Learning Solutions Destiny through 20.0_1U. via the handlewpesearchform.do. searchString. | ||
| CVE-2023-37225 | Med | 0.40 | 6.1 | 0.00 | Dec 25, 2023 | Pexip Infinity before 32 allows Webapp1 XSS via preconfigured links. | ||
| CVE-2022-43675 | Med | 0.40 | 6.1 | 0.00 | Dec 25, 2023 | An issue was discovered in NOKIA NFM-T R19.9. Reflected XSS in the Network Element Manager exists via /oms1350/pages/otn/cpbLogDisplay via the filename parameter, under /oms1350/pages/otn/connection/E2ERoutingDisplayWithOverLay via the id parameter, and under… | ||
| CVE-2022-41762 | Med | 0.40 | 6.1 | 0.00 | Dec 25, 2023 | An issue was discovered in NOKIA NFM-T R19.9. Multiple Reflected XSS vulnerabilities exist in the Network Element Manager via any parameter to log.pl, the bench or pid parameter to top.pl, or the id parameter to easy1350.pl. | ||
| CVE-2023-49088 | Med | 0.40 | 6.1 | 0.01 | Dec 22, 2023 | Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious… | ||
| CVE-2023-51704 | Med | 0.40 | 6.1 | 0.01 | Dec 22, 2023 | An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php, group-*-member messages can result in XSS on Special:log/rights. | ||
| CVE-2023-6122 | Med | 0.40 | 6.1 | 0.00 | Dec 21, 2023 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in İstanbul Soft Informatics and Consultancy Limited Company Softomi Gelişmiş C2C Pazaryeri Yazılımı allows Reflected XSS. This issue affects Softomi Gelişmiş C2C… | ||
| CVE-2023-5989 | Med | 0.40 | 6.1 | 0.00 | Dec 21, 2023 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uyumsoft Information System and Technologies' LioXERP allows an authenticated user to execute Stored XSS. This issue affects LioXERP: before v.146. | ||
| CVE-2023-5988 | Med | 0.40 | 6.1 | 0.00 | Dec 21, 2023 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uyumsoft Information System and Technologies LioXERP allows Reflected XSS. This issue affects LioXERP: before v.146. | ||
| CVE-2023-49489 | Med | 0.40 | 6.1 | 0.01 | Dec 19, 2023 | Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APP_HOST parameter at config/i18n/en/main.php. | ||
| CVE-2023-5348 | Med | 0.40 | 6.1 | 0.01 | Dec 18, 2023 | The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users. | ||
| CVE-2023-6838 | — | Med | 0.40 | 6.1 | 0.00 | Dec 15, 2023 | Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests. | |
| CVE-2023-6571 | Med | 0.40 | 6.1 | 0.00 | Dec 14, 2023 | Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow | ||
| CVE-2023-40659 | Med | 0.40 | 6.1 | 0.00 | Dec 14, 2023 | A reflected XSS vulnerability was discovered in the Easy Quick Contact module for Joomla. | ||
| CVE-2023-40658 | Med | 0.40 | 6.1 | 0.00 | Dec 14, 2023 | A reflected XSS vulnerability was discovered in the Clicky Analytics Dashboard module for Joomla. | ||
| CVE-2023-40657 | Med | 0.40 | 6.1 | 0.00 | Dec 14, 2023 | A reflected XSS vulnerability was discovered in the Joomdoc component for Joomla. | ||
| CVE-2023-40656 | Med | 0.40 | 6.1 | 0.00 | Dec 14, 2023 | A reflected XSS vulnerability was discovered in the Quickform component for Joomla. |
- risk 0.40cvss 6.1epss 0.01
Reflected Cross Site Scripting (XSS) vulnerability in Shaarli v0.12.2, allows remote attackers to execute arbitrary code via search tag function.
- risk 0.40cvss 6.1epss 0.00
The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- risk 0.40cvss 6.1epss 0.00
The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.00
A Cross Site Scripting (XSS) vulnerability exists in Follet Learning Solutions Destiny through 20.0_1U. via the handlewpesearchform.do. searchString.
- risk 0.40cvss 6.1epss 0.00
Pexip Infinity before 32 allows Webapp1 XSS via preconfigured links.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in NOKIA NFM-T R19.9. Reflected XSS in the Network Element Manager exists via /oms1350/pages/otn/cpbLogDisplay via the filename parameter, under /oms1350/pages/otn/connection/E2ERoutingDisplayWithOverLay via the id parameter, and under…
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in NOKIA NFM-T R19.9. Multiple Reflected XSS vulnerabilities exist in the Network Element Manager via any parameter to log.pl, the bench or pid parameter to top.pl, or the id parameter to easy1350.pl.
- risk 0.40cvss 6.1epss 0.01
Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php, group-*-member messages can result in XSS on Special:log/rights.
- risk 0.40cvss 6.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in İstanbul Soft Informatics and Consultancy Limited Company Softomi Gelişmiş C2C Pazaryeri Yazılımı allows Reflected XSS. This issue affects Softomi Gelişmiş C2C…
- risk 0.40cvss 6.1epss 0.00
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uyumsoft Information System and Technologies' LioXERP allows an authenticated user to execute Stored XSS. This issue affects LioXERP: before v.146.
- risk 0.40cvss 6.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uyumsoft Information System and Technologies LioXERP allows Reflected XSS. This issue affects LioXERP: before v.146.
- risk 0.40cvss 6.1epss 0.01
Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APP_HOST parameter at config/i18n/en/main.php.
- risk 0.40cvss 6.1epss 0.01
The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users.
- risk 0.40cvss 6.1epss 0.00
Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests.
- risk 0.40cvss 6.1epss 0.00
Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow
- risk 0.40cvss 6.1epss 0.00
A reflected XSS vulnerability was discovered in the Easy Quick Contact module for Joomla.
- risk 0.40cvss 6.1epss 0.00
A reflected XSS vulnerability was discovered in the Clicky Analytics Dashboard module for Joomla.
- risk 0.40cvss 6.1epss 0.00
A reflected XSS vulnerability was discovered in the Joomdoc component for Joomla.
- risk 0.40cvss 6.1epss 0.00
A reflected XSS vulnerability was discovered in the Quickform component for Joomla.