CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 746 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-35759 | Med | 0.40 | 6.1 | 0.02 | Jun 23, 2023 | In Progress WhatsUp Gold before 23.0.0, an SNMP-related application endpoint failed to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, aka XSS. | ||
| CVE-2023-36287 | Med | 0.40 | 6.1 | 0.01 | Jun 23, 2023 | An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter. | ||
| CVE-2023-36289 | Med | 0.40 | 6.1 | 0.01 | Jun 23, 2023 | An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST email_create and back parameter. | ||
| CVE-2023-34796 | Med | 0.40 | 6.1 | 0.01 | Jun 22, 2023 | Cross site scripting (XSS) vulnerabiliy in dmarcts-report-viewer dashboard versions 1.1 and thru commit 8a1d882b4c481a05e296e9b38a7961e912146a0f, allows unauthenticated attackers to execute arbitrary code via the org_name or domain values. | ||
| CVE-2023-33387 | Med | 0.40 | 6.1 | 0.01 | Jun 22, 2023 | A reflected cross-site scripting (XSS) vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link. | ||
| CVE-2023-33591 | Med | 0.40 | 6.1 | 0.00 | Jun 21, 2023 | User Registration & Login and User Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/search-result.php. | ||
| CVE-2023-33725 | Med | 0.40 | 6.1 | 0.01 | Jun 21, 2023 | Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was discovered to contain a cross-site scripting (XSS) vulnerability via a customer signup with a crafted email address. This is fixed in 6.2.6.1-GA. | ||
| CVE-2020-21485 | Med | 0.40 | 6.1 | 0.01 | Jun 20, 2023 | Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to executea arbitrary code via the path parameter in the browse board component. | ||
| CVE-2020-21268 | Med | 0.40 | 6.1 | 0.01 | Jun 20, 2023 | Cross Site Scripting vulnerability in EasySoft ZenTao v.11.6.4 allows a remote attacker to execute arbitrary code via the lastComment parameter. | ||
| CVE-2020-21058 | Med | 0.40 | 6.1 | 0.01 | Jun 20, 2023 | Cross Site Scripting vulnerability in Typora v.0.9.79 allows a remote attacker to execute arbitrary code via the mermaid sytax. | ||
| CVE-2020-21052 | Med | 0.40 | 6.1 | 0.01 | Jun 20, 2023 | Cross Site Scripting vulnerability in zrlog zrlog v.2.1.3 allows a remote attacker to execute arbitrary code via the nickame parameter of the /post/addComment function. | ||
| CVE-2020-20725 | Med | 0.40 | 6.1 | 0.01 | Jun 20, 2023 | Cross Site Scripting vulnerability in taogogo taoCMS v.2.5 beta5.1 allows remote attacker to execute arbitrary code via the name field in admin.php. | ||
| CVE-2020-20070 | Med | 0.40 | 6.1 | 0.01 | Jun 20, 2023 | Cross Site Scripting vulnerability found in wkeyuan DWSurvey 1.0 allows a remote attacker to execute arbitrary code via thequltemld parameter of the qu-multi-fillblank!answers.action file. | ||
| CVE-2023-33495 | Med | 0.40 | 6.1 | 0.01 | Jun 20, 2023 | Craft CMS through 4.4.9 is vulnerable to HTML Injection. | ||
| CVE-2023-24031 | Med | 0.40 | 6.1 | 0.00 | Jun 15, 2023 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15. XSS can occur, via one of attributes of the webmail /h/ endpoint, to execute arbitrary JavaScript code, leading to information disclosure. | ||
| CVE-2023-34666 | Med | 0.40 | 6.1 | 0.01 | Jun 15, 2023 | Cross-site scripting (XSS) vulnerability in Phpgurukul Cyber Cafe Management System 1.0 allows remote attackers to inject arbitrary web script or HTML via the admin username parameter. | ||
| CVE-2023-3193 | Med | 0.40 | 6.1 | 0.00 | Jun 15, 2023 | Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_layout_admin_web_portlet_Gr… | ||
| CVE-2021-31280 | Med | 0.40 | 6.1 | 0.00 | Jun 14, 2023 | An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the keywords parameter. | ||
| CVE-2020-22402 | Med | 0.40 | 6.1 | 0.00 | Jun 14, 2023 | Cross Site Scripting (XSS) vulnerability in SOGo Web Mail before 4.3.1 allows attackers to obtain user sensitive information when a user reads an email containing malicious code. | ||
| CVE-2023-24469 | Med | 0.40 | 6.1 | 0.00 | Jun 13, 2023 | Potential Cross-Site Scripting in ArcSight Logger versions prior to 7.3.0 |
- risk 0.40cvss 6.1epss 0.02
In Progress WhatsUp Gold before 23.0.0, an SNMP-related application endpoint failed to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, aka XSS.
- risk 0.40cvss 6.1epss 0.01
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter.
- risk 0.40cvss 6.1epss 0.01
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST email_create and back parameter.
- risk 0.40cvss 6.1epss 0.01
Cross site scripting (XSS) vulnerabiliy in dmarcts-report-viewer dashboard versions 1.1 and thru commit 8a1d882b4c481a05e296e9b38a7961e912146a0f, allows unauthenticated attackers to execute arbitrary code via the org_name or domain values.
- risk 0.40cvss 6.1epss 0.01
A reflected cross-site scripting (XSS) vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link.
- risk 0.40cvss 6.1epss 0.00
User Registration & Login and User Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/search-result.php.
- risk 0.40cvss 6.1epss 0.01
Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was discovered to contain a cross-site scripting (XSS) vulnerability via a customer signup with a crafted email address. This is fixed in 6.2.6.1-GA.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to executea arbitrary code via the path parameter in the browse board component.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting vulnerability in EasySoft ZenTao v.11.6.4 allows a remote attacker to execute arbitrary code via the lastComment parameter.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting vulnerability in Typora v.0.9.79 allows a remote attacker to execute arbitrary code via the mermaid sytax.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting vulnerability in zrlog zrlog v.2.1.3 allows a remote attacker to execute arbitrary code via the nickame parameter of the /post/addComment function.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting vulnerability in taogogo taoCMS v.2.5 beta5.1 allows remote attacker to execute arbitrary code via the name field in admin.php.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting vulnerability found in wkeyuan DWSurvey 1.0 allows a remote attacker to execute arbitrary code via thequltemld parameter of the qu-multi-fillblank!answers.action file.
- risk 0.40cvss 6.1epss 0.01
Craft CMS through 4.4.9 is vulnerable to HTML Injection.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15. XSS can occur, via one of attributes of the webmail /h/ endpoint, to execute arbitrary JavaScript code, leading to information disclosure.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Phpgurukul Cyber Cafe Management System 1.0 allows remote attackers to inject arbitrary web script or HTML via the admin username parameter.
- risk 0.40cvss 6.1epss 0.00
Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_layout_admin_web_portlet_Gr…
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the keywords parameter.
- risk 0.40cvss 6.1epss 0.00
Cross Site Scripting (XSS) vulnerability in SOGo Web Mail before 4.3.1 allows attackers to obtain user sensitive information when a user reads an email containing malicious code.
- risk 0.40cvss 6.1epss 0.00
Potential Cross-Site Scripting in ArcSight Logger versions prior to 7.3.0