CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 730 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-49215 | Med | 0.40 | 6.1 | 0.00 | Nov 23, 2023 | Usedesk before 1.7.57 allows filter reflected XSS. | ||
| CVE-2023-4594 | Med | 0.40 | 6.1 | 0.00 | Nov 23, 2023 | Stored XSS vulnerability. This vulnerability could allow an attacker to store a malicious JavaScript payload via GET and POST methods on multiple parameters in the MailAdmin_dll.htm file. | ||
| CVE-2023-4406 | Med | 0.40 | 6.1 | 0.01 | Nov 23, 2023 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but… | ||
| CVE-2023-47417 | Med | 0.40 | 6.1 | 0.01 | Nov 20, 2023 | Cross Site Scripting (XSS) vulnerability in the component /shells/embedder.html of DZSlides after v2011.07.25 allows attackers to execute arbitrary code via a crafted payload. | ||
| CVE-2023-5609 | Med | 0.40 | 6.1 | 0.01 | Nov 20, 2023 | The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | ||
| CVE-2023-5140 | Med | 0.40 | 6.1 | 0.01 | Nov 20, 2023 | The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | ||
| CVE-2023-38883 | Med | 0.40 | 6.1 | 0.01 | Nov 20, 2023 | A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'ajax' parameter in… | ||
| CVE-2023-38882 | Med | 0.40 | 6.1 | 0.01 | Nov 20, 2023 | A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'include' parameter in… | ||
| CVE-2023-38881 | — | Med | 0.40 | 6.1 | 0.01 | Nov 20, 2023 | A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into any of the 'calendar_id',… | |
| CVE-2023-47175 | Med | 0.40 | 6.1 | 0.01 | Nov 20, 2023 | Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the product. | ||
| CVE-2023-40817 | Med | 0.40 | 6.1 | 0.00 | Nov 18, 2023 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field. | ||
| CVE-2023-40816 | Med | 0.40 | 6.1 | 0.00 | Nov 18, 2023 | OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field. | ||
| CVE-2023-40815 | Med | 0.40 | 6.1 | 0.00 | Nov 18, 2023 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field. | ||
| CVE-2023-40814 | Med | 0.40 | 6.1 | 0.00 | Nov 18, 2023 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field. | ||
| CVE-2023-40813 | Med | 0.40 | 6.1 | 0.00 | Nov 18, 2023 | OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation. | ||
| CVE-2023-40812 | Med | 0.40 | 6.1 | 0.00 | Nov 18, 2023 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field. | ||
| CVE-2023-40810 | Med | 0.40 | 6.1 | 0.00 | Nov 18, 2023 | OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field. | ||
| CVE-2023-40809 | Med | 0.40 | 6.1 | 0.00 | Nov 18, 2023 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number. | ||
| CVE-2020-11448 | Med | 0.40 | 6.1 | 0.00 | Nov 17, 2023 | An issue was discovered on Bell HomeHub 3000 SG48222070 devices. There is XSS related to the email field and the login page. | ||
| CVE-2023-4602 | Med | 0.40 | 6.1 | 0.01 | Nov 15, 2023 | The Namaste! LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'course_id' parameter in versions up to, and including, 2.6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to… |
- risk 0.40cvss 6.1epss 0.00
Usedesk before 1.7.57 allows filter reflected XSS.
- risk 0.40cvss 6.1epss 0.00
Stored XSS vulnerability. This vulnerability could allow an attacker to store a malicious JavaScript payload via GET and POST methods on multiple parameters in the MailAdmin_dll.htm file.
- risk 0.40cvss 6.1epss 0.01
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but…
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability in the component /shells/embedder.html of DZSlides after v2011.07.25 allows attackers to execute arbitrary code via a crafted payload.
- risk 0.40cvss 6.1epss 0.01
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- risk 0.40cvss 6.1epss 0.01
The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- risk 0.40cvss 6.1epss 0.01
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'ajax' parameter in…
- risk 0.40cvss 6.1epss 0.01
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'include' parameter in…
- risk 0.40cvss 6.1epss 0.01
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into any of the 'calendar_id',…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the product.
- risk 0.40cvss 6.1epss 0.00
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field.
- risk 0.40cvss 6.1epss 0.00
OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field.
- risk 0.40cvss 6.1epss 0.00
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field.
- risk 0.40cvss 6.1epss 0.00
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field.
- risk 0.40cvss 6.1epss 0.00
OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation.
- risk 0.40cvss 6.1epss 0.00
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field.
- risk 0.40cvss 6.1epss 0.00
OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field.
- risk 0.40cvss 6.1epss 0.00
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered on Bell HomeHub 3000 SG48222070 devices. There is XSS related to the email field and the login page.
- risk 0.40cvss 6.1epss 0.01
The Namaste! LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'course_id' parameter in versions up to, and including, 2.6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…