CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 749 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-28467 | Med | 0.40 | 6.1 | 0.01 | May 22, 2023 | In MyBB before 1.8.34, there is XSS in the User CP module via the user email field. | ||
| CVE-2023-1996 | Med | 0.40 | 6.1 | 0.00 | May 19, 2023 | A reflected Cross-site Scripting (XSS) vulnerability in Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code. | ||
| CVE-2023-29720 | Med | 0.40 | 6.1 | 0.00 | May 18, 2023 | SofaWiki <=3.8.9 is vulnerable to Cross Site Scripting (XSS) via index.php. | ||
| CVE-2023-29837 | Med | 0.40 | 6.1 | 0.00 | May 17, 2023 | Cross Site Scripting vulnerability found in Exelysis Unified Communication Solution (EUCS) v.1.0 allows a remote attacker to gain privileges via the URL path of the eucsAdmin login web page. | ||
| CVE-2022-45144 | Med | 0.40 | 6.1 | 0.01 | May 17, 2023 | Algoo Tracim before 4.4.2 allows XSS via HTML file upload. | ||
| CVE-2023-2710 | Med | 0.40 | 6.1 | 0.01 | May 16, 2023 | The video carousel slider with lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possible for… | ||
| CVE-2023-2708 | Med | 0.40 | 6.1 | 0.01 | May 16, 2023 | The Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to… | ||
| CVE-2022-48020 | Med | 0.40 | 6.1 | 0.01 | May 12, 2023 | Vinteo VCC v2.36.4 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the conference parameter. This vulnerability allows attackers to inject arbitrary code which will be executed by the victim user's browser. | ||
| CVE-2023-27237 | Med | 0.40 | 6.1 | 0.01 | May 12, 2023 | LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack. | ||
| CVE-2023-29808 | Med | 0.40 | 6.1 | 0.01 | May 12, 2023 | Cross Site Scripting (XSS) vulnerability in vogtmh cmaps (companymaps) 8.0 allows attackers to execute arbitrary code. | ||
| CVE-2021-39036 | Med | 0.40 | 6.1 | 0.01 | May 12, 2023 | IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2023-28358 | Med | 0.40 | 6.1 | 0.00 | May 11, 2023 | A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature allows the insertion of malicious tags. This can be exploited on servers with content security policy disabled possible leading to some issues attacks like account… | ||
| CVE-2023-29791 | Med | 0.40 | 6.1 | 0.00 | May 11, 2023 | kodbox <= 1.37 is vulnerable to Cross Site Scripting (XSS) via the debug information. | ||
| CVE-2023-30394 | Med | 0.40 | 6.1 | 0.01 | May 11, 2023 | The MoveIt framework 1.1.11 for ROS allows cross-site scripting (XSS) via the API authentication function. NOTE: this issue is disputed by the original reporter because it has "no impact." | ||
| CVE-2023-27918 | Med | 0.40 | 6.1 | 0.01 | May 10, 2023 | Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated attacker to inject an arbitrary script by having a user who is logging in the WordPress where the product is installed… | ||
| CVE-2023-25831 | Med | 0.40 | 6.1 | 0.01 | May 9, 2023 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. | ||
| CVE-2023-25830 | Med | 0.40 | 6.1 | 0.01 | May 9, 2023 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and before which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. | ||
| CVE-2023-31801 | Med | 0.40 | 6.1 | 0.00 | May 9, 2023 | Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parameter. | ||
| CVE-2020-18280 | Med | 0.40 | 6.1 | 0.00 | May 9, 2023 | Cross Site Scripting vulnerability found in Phodal CMD v.1.0 allows a local attacker to execute arbitrary code via the EMBED SRC function. | ||
| CVE-2023-31406 | Med | 0.40 | 6.1 | 0.00 | May 9, 2023 | Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or modify information… |
- risk 0.40cvss 6.1epss 0.01
In MyBB before 1.8.34, there is XSS in the User CP module via the user email field.
- risk 0.40cvss 6.1epss 0.00
A reflected Cross-site Scripting (XSS) vulnerability in Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code.
- risk 0.40cvss 6.1epss 0.00
SofaWiki <=3.8.9 is vulnerable to Cross Site Scripting (XSS) via index.php.
- risk 0.40cvss 6.1epss 0.00
Cross Site Scripting vulnerability found in Exelysis Unified Communication Solution (EUCS) v.1.0 allows a remote attacker to gain privileges via the URL path of the eucsAdmin login web page.
- risk 0.40cvss 6.1epss 0.01
Algoo Tracim before 4.4.2 allows XSS via HTML file upload.
- risk 0.40cvss 6.1epss 0.01
The video carousel slider with lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possible for…
- risk 0.40cvss 6.1epss 0.01
The Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
- risk 0.40cvss 6.1epss 0.01
Vinteo VCC v2.36.4 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the conference parameter. This vulnerability allows attackers to inject arbitrary code which will be executed by the victim user's browser.
- risk 0.40cvss 6.1epss 0.01
LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability in vogtmh cmaps (companymaps) 8.0 allows attackers to execute arbitrary code.
- risk 0.40cvss 6.1epss 0.01
IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.40cvss 6.1epss 0.00
A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature allows the insertion of malicious tags. This can be exploited on servers with content security policy disabled possible leading to some issues attacks like account…
- risk 0.40cvss 6.1epss 0.00
kodbox <= 1.37 is vulnerable to Cross Site Scripting (XSS) via the debug information.
- risk 0.40cvss 6.1epss 0.01
The MoveIt framework 1.1.11 for ROS allows cross-site scripting (XSS) via the API authentication function. NOTE: this issue is disputed by the original reporter because it has "no impact."
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated attacker to inject an arbitrary script by having a user who is logging in the WordPress where the product is installed…
- risk 0.40cvss 6.1epss 0.01
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.
- risk 0.40cvss 6.1epss 0.01
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and before which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.
- risk 0.40cvss 6.1epss 0.00
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parameter.
- risk 0.40cvss 6.1epss 0.00
Cross Site Scripting vulnerability found in Phodal CMD v.1.0 allows a local attacker to execute arbitrary code via the EMBED SRC function.
- risk 0.40cvss 6.1epss 0.00
Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or modify information…