CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 732 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-47259 | Med | 0.40 | 6.1 | 0.00 | Nov 5, 2023 | Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter. | ||
| CVE-2023-47258 | Med | 0.40 | 6.1 | 0.00 | Nov 5, 2023 | Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter. | ||
| CVE-2023-46964 | Med | 0.40 | 6.1 | 0.01 | Nov 5, 2023 | Cross Site Scripting (XSS) vulnerability in Hillstone Next Generation FireWall SG-6000-e3960 v.5.5 allows a remote attacker to execute arbitrary code via the use front-end filtering instead of back-end filtering. | ||
| CVE-2023-5946 | Med | 0.40 | 6.1 | 0.00 | Nov 3, 2023 | The Digirisk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'current_group_id' parameter in version 6.0.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web… | ||
| CVE-2023-4592 | Med | 0.40 | 6.1 | 0.00 | Nov 3, 2023 | A Cross-Site Scripting vulnerability has been detected in WPN-XM Serverstack affecting version 0.8.6. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload through the /tools/webinterface/index.php parameter and retrieve the cookie… | ||
| CVE-2023-29043 | Med | 0.40 | 6.1 | 0.00 | Nov 2, 2023 | Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a document. Script code embedded in malicious documents could be executed in the context of the user editing the document when… | ||
| CVE-2023-5480 | Med | 0.40 | 6.1 | 0.01 | Nov 1, 2023 | Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a malicious file. (Chromium security severity: High) | ||
| CVE-2023-46911 | Med | 0.40 | 6.1 | 0.00 | Nov 1, 2023 | There is a Cross Site Scripting (XSS) vulnerability in the choose_style_tree.do interface of Jspxcms v10.2.0 backend. | ||
| CVE-2023-20206 | Med | 0.40 | 6.1 | 0.01 | Nov 1, 2023 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected device. These… | ||
| CVE-2023-44484 | Med | 0.40 | 6.1 | 0.00 | Oct 31, 2023 | Online Blood Donation Management System v1.0 is vulnerable to a Stored Cross-Site Scripting vulnerability. The 'firstName' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the… | ||
| CVE-2023-5307 | Med | 0.40 | 6.1 | 0.01 | Oct 31, 2023 | The Photos and Files Contest Gallery WordPress plugin before 21.2.8.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks via certain headers. | ||
| CVE-2023-5238 | Med | 0.40 | 6.1 | 0.00 | Oct 31, 2023 | The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website. | ||
| CVE-2023-5211 | Med | 0.40 | 6.1 | 0.00 | Oct 31, 2023 | The Fattura24 WordPress plugin before 6.2.8 does not sanitize or escape the 'id' parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting vulnerability. | ||
| CVE-2023-4250 | Med | 0.40 | 6.1 | 0.00 | Oct 31, 2023 | The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | ||
| CVE-2023-46503 | Med | 0.40 | 6.1 | 0.01 | Oct 27, 2023 | Cross Site Scripting (XSS) vulnerability in PwnCYN YXBOOKCMS v.1.0.2 allows a remote attacker to execute arbitrary code via the reader management and book input modules. | ||
| CVE-2023-46505 | Med | 0.40 | 6.1 | 0.00 | Oct 27, 2023 | Cross Site Scripting vulnerability in FanCMS v.1.0.0 allows an attacker to execute arbitrary code via the content1 parameter in the demo.php file. | ||
| CVE-2023-46491 | Med | 0.40 | 6.1 | 0.00 | Oct 27, 2023 | ZenTao Biz version 4.1.3 and before has a Cross Site Scripting (XSS) vulnerability in the Version Library. | ||
| CVE-2023-46374 | Med | 0.40 | 6.1 | 0.00 | Oct 27, 2023 | ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS). | ||
| CVE-2023-43906 | Med | 0.40 | 6.1 | 0.00 | Oct 26, 2023 | Xolo CMS v0.11 was discovered to contain a reflected cross-site scripting (XSS) vulnerability. | ||
| CVE-2023-46583 | Med | 0.40 | 6.1 | 0.00 | Oct 25, 2023 | Cross-Site Scripting (XSS) vulnerability in PHPGurukul Nipah virus (NiV) " Testing Management System v.1.0 allows attackers to execute arbitrary code via a crafted payload injected into the State field. |
- risk 0.40cvss 6.1epss 0.00
Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter.
- risk 0.40cvss 6.1epss 0.00
Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability in Hillstone Next Generation FireWall SG-6000-e3960 v.5.5 allows a remote attacker to execute arbitrary code via the use front-end filtering instead of back-end filtering.
- risk 0.40cvss 6.1epss 0.00
The Digirisk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'current_group_id' parameter in version 6.0.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
- risk 0.40cvss 6.1epss 0.00
A Cross-Site Scripting vulnerability has been detected in WPN-XM Serverstack affecting version 0.8.6. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload through the /tools/webinterface/index.php parameter and retrieve the cookie…
- risk 0.40cvss 6.1epss 0.00
Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a document. Script code embedded in malicious documents could be executed in the context of the user editing the document when…
- risk 0.40cvss 6.1epss 0.01
Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a malicious file. (Chromium security severity: High)
- risk 0.40cvss 6.1epss 0.00
There is a Cross Site Scripting (XSS) vulnerability in the choose_style_tree.do interface of Jspxcms v10.2.0 backend.
- risk 0.40cvss 6.1epss 0.01
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected device. These…
- risk 0.40cvss 6.1epss 0.00
Online Blood Donation Management System v1.0 is vulnerable to a Stored Cross-Site Scripting vulnerability. The 'firstName' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the…
- risk 0.40cvss 6.1epss 0.01
The Photos and Files Contest Gallery WordPress plugin before 21.2.8.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks via certain headers.
- risk 0.40cvss 6.1epss 0.00
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website.
- risk 0.40cvss 6.1epss 0.00
The Fattura24 WordPress plugin before 6.2.8 does not sanitize or escape the 'id' parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting vulnerability.
- risk 0.40cvss 6.1epss 0.00
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability in PwnCYN YXBOOKCMS v.1.0.2 allows a remote attacker to execute arbitrary code via the reader management and book input modules.
- risk 0.40cvss 6.1epss 0.00
Cross Site Scripting vulnerability in FanCMS v.1.0.0 allows an attacker to execute arbitrary code via the content1 parameter in the demo.php file.
- risk 0.40cvss 6.1epss 0.00
ZenTao Biz version 4.1.3 and before has a Cross Site Scripting (XSS) vulnerability in the Version Library.
- risk 0.40cvss 6.1epss 0.00
ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.00
Xolo CMS v0.11 was discovered to contain a reflected cross-site scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.00
Cross-Site Scripting (XSS) vulnerability in PHPGurukul Nipah virus (NiV) " Testing Management System v.1.0 allows attackers to execute arbitrary code via a crafted payload injected into the State field.