CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 745 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-37254 | Med | 0.40 | 6.1 | 0.00 | Jun 29, 2023 | An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. XSS can occur in Special:CargoQuery via a crafted page item when using the default format. | ||
| CVE-2023-37251 | Med | 0.40 | 6.1 | 0.00 | Jun 29, 2023 | An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3. The googleanalyticstrackurl parser function does not properly escape JavaScript in the onclick handler and does not prevent use of javascript: URLs. | ||
| CVE-2023-34599 | Med | 0.40 | 6.1 | 0.02 | Jun 29, 2023 | Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code. | ||
| CVE-2023-34486 | Med | 0.40 | 6.1 | 0.01 | Jun 29, 2023 | itsourcecode Online Hotel Management System Project In PHP v1.0.0 is vulnerable to Cross Site Scripting (XSS). Remote code execution can be achieved by entering malicious code in the date selection box. | ||
| CVE-2023-34648 | Med | 0.40 | 6.1 | 0.00 | Jun 29, 2023 | A Cross Site Scripting vulnerability in PHPgurukl User Registration Login and User Management System with admin panel v.1.0 allows a local attacker to execute arbitrary code via a crafted script to the signup.php. | ||
| CVE-2023-33661 | Med | 0.40 | 6.1 | 0.01 | Jun 29, 2023 | Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters. | ||
| CVE-2023-34647 | Med | 0.40 | 6.1 | 0.00 | Jun 28, 2023 | PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS). | ||
| CVE-2023-34652 | Med | 0.40 | 6.1 | 0.00 | Jun 28, 2023 | PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS) via Add New Course. | ||
| CVE-2023-34651 | Med | 0.40 | 6.1 | 0.00 | Jun 28, 2023 | PHPgurukl Hospital Management System v.1.0 is vulnerable to Cross Site Scripting (XSS). | ||
| CVE-2023-34650 | Med | 0.40 | 6.1 | 0.00 | Jun 28, 2023 | PHPgurukl Small CRM v.1.0 is vulnerable to Cross Site Scripting (XSS). | ||
| CVE-2021-25828 | Med | 0.40 | 6.1 | 0.01 | Jun 28, 2023 | Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web. | ||
| CVE-2023-20119 | Med | 0.40 | 6.1 | 0.01 | Jun 28, 2023 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack… | ||
| CVE-2023-32339 | Med | 0.40 | 6.1 | 0.00 | Jun 27, 2023 | IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2021-30203 | Med | 0.40 | 6.1 | 0.01 | Jun 27, 2023 | A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers to execute arbitrary web scripts or HTML. | ||
| CVE-2023-32535 | Med | 0.40 | 6.1 | 0.02 | Jun 26, 2023 | Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32531 through 32534. | ||
| CVE-2023-32534 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2023 | Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32531 through 32535. | ||
| CVE-2023-32533 | Med | 0.40 | 6.1 | 0.02 | Jun 26, 2023 | Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32531 through 32535. | ||
| CVE-2023-32532 | Med | 0.40 | 6.1 | 0.02 | Jun 26, 2023 | Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32531 through 32535. | ||
| CVE-2023-32531 | Med | 0.40 | 6.1 | 0.02 | Jun 26, 2023 | Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32532 through 32535. | ||
| CVE-2023-36675 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2023 | An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature. |
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. XSS can occur in Special:CargoQuery via a crafted page item when using the default format.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3. The googleanalyticstrackurl parser function does not properly escape JavaScript in the onclick handler and does not prevent use of javascript: URLs.
- risk 0.40cvss 6.1epss 0.02
Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.
- risk 0.40cvss 6.1epss 0.01
itsourcecode Online Hotel Management System Project In PHP v1.0.0 is vulnerable to Cross Site Scripting (XSS). Remote code execution can be achieved by entering malicious code in the date selection box.
- risk 0.40cvss 6.1epss 0.00
A Cross Site Scripting vulnerability in PHPgurukl User Registration Login and User Management System with admin panel v.1.0 allows a local attacker to execute arbitrary code via a crafted script to the signup.php.
- risk 0.40cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters.
- risk 0.40cvss 6.1epss 0.00
PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.00
PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS) via Add New Course.
- risk 0.40cvss 6.1epss 0.00
PHPgurukl Hospital Management System v.1.0 is vulnerable to Cross Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.00
PHPgurukl Small CRM v.1.0 is vulnerable to Cross Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.01
Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web.
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, formerly known as Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack…
- risk 0.40cvss 6.1epss 0.00
IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.40cvss 6.1epss 0.01
A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers to execute arbitrary web scripts or HTML.
- risk 0.40cvss 6.1epss 0.02
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32531 through 32534.
- risk 0.40cvss 6.1epss 0.01
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32531 through 32535.
- risk 0.40cvss 6.1epss 0.02
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32531 through 32535.
- risk 0.40cvss 6.1epss 0.02
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32531 through 32535.
- risk 0.40cvss 6.1epss 0.02
Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32532 through 32535.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.