VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,563)

page 740 of 2,429
  • CVE-2020-20523MedAug 11, 2023
    Gila
    CMS
    risk 0.40cvss 6.1epss 0.01

    Cross Site Scripting (XSS) vulnerability in adm_user parameter in Gila CMS version 1.11.3, allows remote attackers to execute arbitrary code during the Gila CMS installation.

  • CVE-2020-19952MedAug 11, 2023
    Jbt
    Live \(github Flavored\) Markdown Editor
    risk 0.40cvss 6.1epss 0.01

    Cross Site Scripting (XSS) vulnerability in Rendering Engine in jbt Markdown Editor thru commit 2252418c27dffbb35147acd8ed324822b8919477, allows remote attackers to execute arbirary code via crafted payload or opening malicious .md file.

  • CVE-2023-38333MedAug 10, 2023
    Zohocorp
    Manageengine Applications Manager
    risk 0.40cvss 6.1epss 0.02

    Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in.

  • CVE-2023-40224MedAug 10, 2023
    Misp
    Misp
    risk 0.40cvss 6.1epss 0.00

    MISP 2.4.174 allows XSS in app/View/Events/index.ctp.

  • CVE-2023-36315MedAug 10, 2023
    Phpjabbers
    Callback Widget
    risk 0.40cvss 6.1epss 0.00

    There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Callback Widget v1.0.

  • CVE-2023-36314MedAug 10, 2023
    Phpjabbers
    Callback Widget
    risk 0.40cvss 6.1epss 0.00

    There is a Cross Site Scripting (XSS) vulnerability in the value-text-o_sms_email_request_message parameters of index.php in PHPJabbers Callback Widget v1.0.

  • CVE-2023-36313MedAug 10, 2023
    Phpjabbers
    Document Creator
    risk 0.40cvss 6.1epss 0.00

    PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting (XSS) via all post parameters of "Export Requests" aside from "request_feed".

  • CVE-2023-36310MedAug 10, 2023
    Phpjabbers
    Document Creator
    risk 0.40cvss 6.1epss 0.00

    There is a Cross Site Scripting (XSS) vulnerability in the "column" parameter of index.php in PHPJabbers Document Creator v1.0.

  • CVE-2023-36309MedAug 10, 2023
    Phpjabbers
    Document Creator
    risk 0.40cvss 6.1epss 0.00

    There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Document Creator v1.0.

  • CVE-2023-38347MedAug 9, 2023
    LWsystems
    Benno MailArchiv
    risk 0.40cvss 6.1epss 0.00

    An issue was discovered in LWsystems Benno MailArchiv 2.10.1. Attackers can cause XSS via JavaScript content to a mailbox.

  • CVE-2023-39002MedAug 9, 2023
    Opnsense
    Opnsense
    risk 0.40cvss 6.1epss 0.01

    A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

  • CVE-2023-38761MedAug 8, 2023
    Churchcrm
    Churchcrm
    risk 0.40cvss 6.1epss 0.01

    Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the systemSettings.php component.

  • CVE-2023-3652MedAug 8, 2023
    Digital Ant
    Digital Ant
    risk 0.40cvss 6.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital Ant E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: before 11.

  • CVE-2023-37488MedAug 8, 2023
    SAP
    SAP_XIAF
    risk 0.40cvss 6.1epss 0.00

    In SAP NetWeaver Process Integration - versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled inputs, if not sufficiently encoded, could result in Cross-Site Scripting (XSS) attack. On successful exploitation the attacker can cause limited impact on…

  • CVE-2023-38045MedAug 7, 2023
    Joomla
    oneVote
    risk 0.40cvss 6.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla. It allows XSS Targeting Non-Script Elements.

  • CVE-2023-38964MedAug 4, 2023
    Creative Item Academy LMS
    Creative Item Academy LMS
    risk 0.40cvss 6.1epss 0.01

    Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability.

  • CVE-2023-36159MedAug 4, 2023
    Sourcecodester
    Lost and Found Information System
    risk 0.40cvss 6.1epss 0.01

    Cross Site Scripting (XSS) vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attackers to run arbitrary code via the First Name, Middle Name and Last Name fields on the Create User page.

  • CVE-2023-36158MedAug 4, 2023
    Sourcecodester
    Toll Tax Management System
    risk 0.40cvss 6.1epss 0.01

    Cross Site Scripting (XSS) vulnerability in sourcecodester Toll Tax Management System 1.0 allows remote attackers to run arbitrary code via the First Name and Last Name fields on the My Account page.

  • CVE-2023-36138MedAug 4, 2023
    Phpjabbers
    Cleaning Business Software
    risk 0.40cvss 6.1epss 0.00

    PHPJabbers Cleaning Business Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the theme parameter of preview.php.

  • CVE-2023-36137MedAug 4, 2023
    Phpjabbers
    Class Scheduling System
    risk 0.40cvss 6.1epss 0.00

    There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Class Scheduling System 1.0.