VYPR

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

BaseStableLikelihood: High

Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Hierarchy (View 1000)

Parents

Related attack patterns (CAPEC)

CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85

CVEs mapped to this weakness (48,563)

page 742 of 2,429
  • CVE-2022-43711MedJul 26, 2023
    GX Software
    XperienCentral
    risk 0.40cvss 6.1epss 0.00

    Interactive Forms (IAF) in GX Software XperienCentral versions 10.29.1 until 10.33.0 was vulnerable to cross site scripting attacks (XSS) because the CSP header uses eval() in the script-src.

  • CVE-2020-35698MedJul 25, 2023
    Thinkific
    Thinkific
    risk 0.40cvss 6.1epss 0.01

    Thinkific Thinkific Online Course Creation Platform 1.0 is affected by: Cross Site Scripting (XSS). The impact is: execute arbitrary code (remote). The component is: Affected Source code of the website CMS which is been used by many to host their online courses using the…

  • CVE-2021-39421MedJul 24, 2023
    Seeddms
    Seeddms
    risk 0.40cvss 6.1epss 0.00

    A cross-site scripting (XSS) vulnerability in SeedDMS v6.0.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

  • CVE-2023-37613MedJul 24, 2023
    Assembly Software
    Trialworks
    risk 0.40cvss 6.1epss 0.00

    A cross-site scripting (XSS) vulnerability in Assembly Software Trialworks v11.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the asset src parameter.

  • CVE-2023-25841MedJul 21, 2023
    Esri
    Arcgis Server
    risk 0.40cvss 6.1epss 0.01

    There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in…

  • CVE-2023-37742MedJul 21, 2023
    Webboss
    Webboss.io CMS
    risk 0.40cvss 6.1epss 0.00

    WebBoss.io CMS before v3.7.0.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability.

  • CVE-2023-32624MedJul 21, 2023
    SAKURA Internet Inc.
    Ts Webfonts For Sakura
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting vulnerability in TS Webfonts for SAKURA 3.1.0 and earlier allows a remote unauthenticated attacker to inject an arbitrary script.

  • CVE-2023-38617MedJul 20, 2023
    Office Suite Premium
    Office Suite Premium
    risk 0.40cvss 6.1epss 0.01

    Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the filter parameter at /api?path=files.

  • CVE-2023-37602MedJul 20, 2023
    Alkacon
    Opencms
    risk 0.40cvss 6.1epss 0.01

    An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.

  • CVE-2023-37600MedJul 20, 2023
    Office Suite Premium
    Office Suite Premium
    risk 0.40cvss 6.1epss 0.01

    Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /api?path=profile.

  • CVE-2023-37164MedJul 20, 2023
    Diafan
    CMS
    risk 0.40cvss 6.1epss 0.01

    Diafan CMS v6.0 was discovered to contain a reflected cross-site scripting via the cat_id parameter at /shop/?module=shop&action=search.

  • CVE-2023-37728MedJul 20, 2023
    IceWarp
    Icewarp
    risk 0.40cvss 6.1epss 0.01

    IceWarp v10.2.1 was discovered to contain cross-site scripting (XSS) vulnerability via the color parameter.

  • CVE-2023-37733MedJul 19, 2023
    Tduckcloud
    Tduck Platform
    risk 0.40cvss 6.1epss 0.00

    An arbitrary file upload vulnerability in tduck-platform v4.0 allows attackers to execute arbitrary code via a crafted HTML file.

  • CVE-2023-22035MedJul 18, 2023
    Oracle Corporation
    Scripting
    risk 0.40cvss 6.1epss 0.00

    Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…

  • CVE-2023-33231MedJul 18, 2023
    SolarWinds
    DPA
    risk 0.40cvss 6.1epss 0.01

    XSS attack was possible in DPA 2023.2 due to insufficient input validation

  • CVE-2023-3708MedJul 18, 2023
    WordPress
    DeoThemes
    risk 0.40cvss 6.1epss 0.01

    Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in…

  • CVE-2023-31853MedJul 17, 2023
    Cudy
    LT400
    risk 0.40cvss 6.1epss 0.01

    Cudy LT400 1.13.4 is vulnerable Cross Site Scripting (XSS) in /cgi-bin/luci/admin/network/bandwidth via the icon parameter.

  • CVE-2023-31851MedJul 17, 2023
    Cudy
    LT400
    risk 0.40cvss 6.1epss 0.01

    Cudy LT400 1.13.4 is has a cross-site scripting (XSS) vulnerability in /cgi-bin/luci/admin/network/wireless/status via the iface parameter.

  • CVE-2023-31852MedJul 17, 2023
    Cudy
    LT400
    risk 0.40cvss 6.1epss 0.01

    Cudy LT400 1.13.4 is vulnerable to Cross Site Scripting (XSS) in cgi-bin/luci/admin/network/wireless/config via the iface parameter.

  • CVE-2023-2960MedJul 17, 2023
    Oliva Expertise
    Oliva Expertise EKS
    risk 0.40cvss 6.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oliva Expertise Oliva Expertise EKS allows Cross-Site Scripting (XSS). This issue affects Oliva Expertise EKS: before 1.2.