CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 728 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-40655 | Med | 0.40 | 6.1 | 0.00 | Dec 14, 2023 | A reflected XSS vulnerability was discovered in the Proforms Basic component for Joomla. | ||
| CVE-2023-40628 | Med | 0.40 | 6.1 | 0.00 | Dec 14, 2023 | A reflected XSS vulnerability was discovered in the Extplorer component for Joomla. | ||
| CVE-2023-40627 | Med | 0.40 | 6.1 | 0.00 | Dec 14, 2023 | A reflected XSS vulnerability was discovered in the LivingWord component for Joomla. | ||
| CVE-2023-41618 | Med | 0.40 | 6.1 | 0.00 | Dec 14, 2023 | Emlog Pro v2.1.14 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin/article.php?active_savedraft. | ||
| CVE-2023-41621 | Med | 0.40 | 6.1 | 0.01 | Dec 13, 2023 | A Cross Site Scripting (XSS) vulnerability was discovered in Emlog Pro v2.1.14 via the component /admin/store.php. | ||
| CVE-2023-47623 | Med | 0.40 | 6.1 | 0.00 | Dec 13, 2023 | Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the login page via the `redirect_uri` parameter. By specifying a url with the javascript scheme (`javascript:`), an attacker can… | ||
| CVE-2023-47620 | Med | 0.40 | 6.1 | 0.00 | Dec 13, 2023 | Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the plugin-http.ts file via the `owner' and 'pkg` parameters. An attacker can run arbitrary JavaScript code. | ||
| CVE-2023-47575 | Med | 0.40 | 6.1 | 0.00 | Dec 13, 2023 | An issue was discovered on Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices. The web interfaces of the Relyum devices are susceptible to reflected XSS. | ||
| CVE-2023-28604 | Med | 0.40 | 6.1 | 0.01 | Dec 12, 2023 | The fluid_components (aka Fluid Components) extension before 3.5.0 for TYPO3 allows XSS via a component argument parameter, for certain {content} use cases that may be edge cases. | ||
| CVE-2023-49563 | Med | 0.40 | 6.1 | 0.01 | Dec 12, 2023 | Cross Site Scripting (XSS) in Voltronic Power SNMP Web Pro v.1.1 allows an attacker to execute arbitrary code via a crafted script within a request to the webserver. | ||
| CVE-2023-49577 | Med | 0.40 | 6.1 | 0.00 | Dec 12, 2023 | The SAP HCM (SMART PAYE solution) - versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604, SAP_HRCIE 608, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact… | ||
| CVE-2023-42479 | Med | 0.40 | 6.1 | 0.00 | Dec 12, 2023 | An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting request to the Biller Direct system. This can result in the disclosure or modification of non-sensitive information. | ||
| CVE-2023-49494 | Med | 0.40 | 6.1 | 0.01 | Dec 11, 2023 | DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEditor.php. | ||
| CVE-2023-49490 | Med | 0.40 | 6.1 | 0.00 | Dec 11, 2023 | XunRuiCMS v4.5.5 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin.php. | ||
| CVE-2023-49488 | Med | 0.40 | 6.1 | 0.00 | Dec 11, 2023 | A cross-site scripting (XSS) vulnerability in Openfiler ESA v2.99.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the nic parameter. | ||
| CVE-2023-5750 | Med | 0.40 | 6.1 | 0.00 | Dec 11, 2023 | The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape a parameter before outputting it back in the page containing a specific content, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | ||
| CVE-2023-5749 | Med | 0.40 | 6.1 | 0.00 | Dec 11, 2023 | The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | ||
| CVE-2023-46693 | Med | 0.40 | 6.1 | 0.00 | Dec 7, 2023 | Cross Site Scripting (XSS) vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters. | ||
| CVE-2023-41170 | Med | 0.40 | 6.1 | 0.00 | Dec 7, 2023 | NetScout nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting vulnerability. | ||
| CVE-2023-49493 | Med | 0.40 | 6.1 | 0.00 | Dec 7, 2023 | DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the v parameter at selectimages.php. |
- risk 0.40cvss 6.1epss 0.00
A reflected XSS vulnerability was discovered in the Proforms Basic component for Joomla.
- risk 0.40cvss 6.1epss 0.00
A reflected XSS vulnerability was discovered in the Extplorer component for Joomla.
- risk 0.40cvss 6.1epss 0.00
A reflected XSS vulnerability was discovered in the LivingWord component for Joomla.
- risk 0.40cvss 6.1epss 0.00
Emlog Pro v2.1.14 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin/article.php?active_savedraft.
- risk 0.40cvss 6.1epss 0.01
A Cross Site Scripting (XSS) vulnerability was discovered in Emlog Pro v2.1.14 via the component /admin/store.php.
- risk 0.40cvss 6.1epss 0.00
Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the login page via the `redirect_uri` parameter. By specifying a url with the javascript scheme (`javascript:`), an attacker can…
- risk 0.40cvss 6.1epss 0.00
Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the plugin-http.ts file via the `owner' and 'pkg` parameters. An attacker can run arbitrary JavaScript code.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered on Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices. The web interfaces of the Relyum devices are susceptible to reflected XSS.
- risk 0.40cvss 6.1epss 0.01
The fluid_components (aka Fluid Components) extension before 3.5.0 for TYPO3 allows XSS via a component argument parameter, for certain {content} use cases that may be edge cases.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) in Voltronic Power SNMP Web Pro v.1.1 allows an attacker to execute arbitrary code via a crafted script within a request to the webserver.
- risk 0.40cvss 6.1epss 0.00
The SAP HCM (SMART PAYE solution) - versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604, SAP_HRCIE 608, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact…
- risk 0.40cvss 6.1epss 0.00
An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting request to the Biller Direct system. This can result in the disclosure or modification of non-sensitive information.
- risk 0.40cvss 6.1epss 0.01
DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEditor.php.
- risk 0.40cvss 6.1epss 0.00
XunRuiCMS v4.5.5 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin.php.
- risk 0.40cvss 6.1epss 0.00
A cross-site scripting (XSS) vulnerability in Openfiler ESA v2.99.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the nic parameter.
- risk 0.40cvss 6.1epss 0.00
The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape a parameter before outputting it back in the page containing a specific content, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- risk 0.40cvss 6.1epss 0.00
The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- risk 0.40cvss 6.1epss 0.00
Cross Site Scripting (XSS) vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters.
- risk 0.40cvss 6.1epss 0.00
NetScout nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting vulnerability.
- risk 0.40cvss 6.1epss 0.00
DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the v parameter at selectimages.php.