CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 751 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-30125 | Med | 0.40 | 6.1 | 0.00 | Apr 28, 2023 | EyouCms V1.6.1-UTF8-sp1 is vulnerable to Cross Site Scripting (XSS). | ||
| CVE-2023-29489 | Med | 0.40 | 5.3 | 0.66 | Apr 27, 2023 | An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31. | ||
| CVE-2023-24966 | Med | 0.40 | 6.1 | 0.00 | Apr 27, 2023 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. … | ||
| CVE-2023-25292 | Med | 0.40 | 6.1 | 0.01 | Apr 27, 2023 | Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GO_LANGUAGE cookie. | ||
| CVE-2023-29442 | Med | 0.40 | 6.1 | 0.09 | Apr 26, 2023 | Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS. | ||
| CVE-2023-29836 | Med | 0.40 | 6.1 | 0.01 | Apr 26, 2023 | Cross Site Scripting vulnerability found in Exelysis Unified Communication Solutions (EUCS) v.1.0 allows a remote attacker to execute arbitrary code via the Username parameter of the eucsAdmin login form. | ||
| CVE-2023-30212 | Med | 0.40 | 6.1 | 0.08 | Apr 26, 2023 | OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php. | ||
| CVE-2023-30210 | Med | 0.40 | 6.1 | 0.01 | Apr 26, 2023 | OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php. | ||
| CVE-2022-25276 | Med | 0.40 | 6.1 | 0.01 | Apr 26, 2023 | The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities. | ||
| CVE-2023-30267 | Med | 0.40 | 6.1 | 0.00 | Apr 26, 2023 | CLTPHP <=6.0 is vulnerable to Cross Site Scripting (XSS) via application/home/controller/Changyan.php. | ||
| CVE-2023-30111 | Med | 0.40 | 6.1 | 0.00 | Apr 26, 2023 | Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS). | ||
| CVE-2023-30106 | Med | 0.40 | 6.1 | 0.01 | Apr 26, 2023 | Sourcecodester Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS) via page=about. | ||
| CVE-2021-45071 | Med | 0.40 | 6.1 | 0.01 | Apr 25, 2023 | Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via crafted uploaded file names. | ||
| CVE-2021-44775 | Med | 0.40 | 6.1 | 0.01 | Apr 25, 2023 | Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents. | ||
| CVE-2021-44461 | Med | 0.40 | 6.1 | 0.00 | Apr 25, 2023 | Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accounting journal entries to inject arbitrary web script in the browser of a victim. | ||
| CVE-2021-26947 | Med | 0.40 | 6.1 | 0.01 | Apr 25, 2023 | Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via a crafted link. | ||
| CVE-2021-26263 | Med | 0.40 | 6.1 | 0.01 | Apr 25, 2023 | Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents. | ||
| CVE-2023-25346 | Med | 0.40 | 6.1 | 0.02 | Apr 25, 2023 | A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found. | ||
| CVE-2022-28354 | Med | 0.40 | 6.1 | 0.01 | Apr 24, 2023 | In the Active Threads Plugin 1.3.0 for MyBB, the activethreads.php date parameter is vulnerable to XSS when setting a time period. | ||
| CVE-2022-47509 | Med | 0.40 | 6.1 | 0.01 | Apr 21, 2023 | The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject HTML. |
- risk 0.40cvss 6.1epss 0.00
EyouCms V1.6.1-UTF8-sp1 is vulnerable to Cross Site Scripting (XSS).
- risk 0.40cvss 5.3epss 0.66
An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.
- risk 0.40cvss 6.1epss 0.00
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. …
- risk 0.40cvss 6.1epss 0.01
Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GO_LANGUAGE cookie.
- risk 0.40cvss 6.1epss 0.09
Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting vulnerability found in Exelysis Unified Communication Solutions (EUCS) v.1.0 allows a remote attacker to execute arbitrary code via the Username parameter of the eucsAdmin login form.
- risk 0.40cvss 6.1epss 0.08
OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.
- risk 0.40cvss 6.1epss 0.01
OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php.
- risk 0.40cvss 6.1epss 0.01
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.
- risk 0.40cvss 6.1epss 0.00
CLTPHP <=6.0 is vulnerable to Cross Site Scripting (XSS) via application/home/controller/Changyan.php.
- risk 0.40cvss 6.1epss 0.00
Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.01
Sourcecodester Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS) via page=about.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via crafted uploaded file names.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.
- risk 0.40cvss 6.1epss 0.00
Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accounting journal entries to inject arbitrary web script in the browser of a victim.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via a crafted link.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.
- risk 0.40cvss 6.1epss 0.02
A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found.
- risk 0.40cvss 6.1epss 0.01
In the Active Threads Plugin 1.3.0 for MyBB, the activethreads.php date parameter is vulnerable to XSS when setting a time period.
- risk 0.40cvss 6.1epss 0.01
The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject HTML.