CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 760 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-0624 | Med | 0.40 | 6.1 | 0.00 | Feb 9, 2023 | OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html. | ||
| CVE-2023-23026 | Med | 0.40 | 6.1 | 0.01 | Feb 7, 2023 | Cross site scripting (XSS) vulnerability in sourcecodester oretnom23 sales management system 1.0, allows attackers to execute arbitrary code via the product_name and product_price inputs in file print.php. | ||
| CVE-2023-23011 | Med | 0.40 | 6.1 | 0.01 | Feb 7, 2023 | Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php. | ||
| CVE-2022-45441 | Med | 0.40 | 6.1 | 0.00 | Feb 7, 2023 | A cross-site scripting (XSS) vulnerability in Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.13)C0, which could allow an attacker to store malicious scripts in the Logs page of the GUI on a vulnerable device. A successful XSS attack could force an authenticated user to… | ||
| CVE-2023-23849 | Med | 0.40 | 6.1 | 0.01 | Feb 6, 2023 | Versions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability. Any web service hosted on the same sub domain can set a cookie for the whole subdomain which can be used to bypass other mitigations in place for malicious… | ||
| CVE-2023-24197 | Med | 0.40 | 6.1 | 0.00 | Feb 6, 2023 | Online Food Ordering System v2 was discovered to contain a SQL injection vulnerability via the id parameter at view_order.php. | ||
| CVE-2023-24195 | Med | 0.40 | 6.1 | 0.00 | Feb 6, 2023 | Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in index.php. | ||
| CVE-2023-24194 | Med | 0.40 | 6.1 | 0.00 | Feb 6, 2023 | Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in navbar.php. | ||
| CVE-2023-24192 | Med | 0.40 | 6.1 | 0.00 | Feb 6, 2023 | Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in login.php. | ||
| CVE-2023-24191 | Med | 0.40 | 6.1 | 0.00 | Feb 6, 2023 | Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in signup.php. | ||
| CVE-2022-45722 | Med | 0.40 | 6.1 | 0.00 | Feb 6, 2023 | ezEIP v5.3.0(0649) was discovered to contain a cross-site scripting (XSS) vulnerability. | ||
| CVE-2023-22849 | Med | 0.40 | 6.1 | 0.01 | Feb 4, 2023 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in multiple features. … | ||
| CVE-2023-0677 | Med | 0.40 | 6.1 | 0.00 | Feb 4, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1. | ||
| CVE-2023-0676 | Med | 0.40 | 6.1 | 0.02 | Feb 4, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1. | ||
| CVE-2021-37518 | Med | 0.40 | 6.1 | 0.01 | Feb 3, 2023 | Universal Cross Site Scripting (UXSS) vulnerability in Vimium Extension 1.66 and earlier allows remote attackers to run arbitrary code via omnibar feature. | ||
| CVE-2023-22975 | Med | 0.40 | 6.1 | 0.00 | Feb 3, 2023 | A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html. | ||
| CVE-2023-0599 | Med | 0.40 | 6.1 | 0.00 | Feb 1, 2023 | Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitization. Using this vulnerability, an authenticated attacker can execute arbitrary HTML and script code in the target… | ||
| CVE-2023-23078 | Med | 0.40 | 6.1 | 0.03 | Feb 1, 2023 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets. | ||
| CVE-2023-23077 | Med | 0.40 | 6.1 | 0.03 | Feb 1, 2023 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment. | ||
| CVE-2023-23075 | Med | 0.40 | 6.1 | 0.03 | Feb 1, 2023 | Cross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation. |
- risk 0.40cvss 6.1epss 0.00
OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.
- risk 0.40cvss 6.1epss 0.01
Cross site scripting (XSS) vulnerability in sourcecodester oretnom23 sales management system 1.0, allows attackers to execute arbitrary code via the product_name and product_price inputs in file print.php.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php.
- risk 0.40cvss 6.1epss 0.00
A cross-site scripting (XSS) vulnerability in Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.13)C0, which could allow an attacker to store malicious scripts in the Logs page of the GUI on a vulnerable device. A successful XSS attack could force an authenticated user to…
- risk 0.40cvss 6.1epss 0.01
Versions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability. Any web service hosted on the same sub domain can set a cookie for the whole subdomain which can be used to bypass other mitigations in place for malicious…
- risk 0.40cvss 6.1epss 0.00
Online Food Ordering System v2 was discovered to contain a SQL injection vulnerability via the id parameter at view_order.php.
- risk 0.40cvss 6.1epss 0.00
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in index.php.
- risk 0.40cvss 6.1epss 0.00
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in navbar.php.
- risk 0.40cvss 6.1epss 0.00
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in login.php.
- risk 0.40cvss 6.1epss 0.00
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in signup.php.
- risk 0.40cvss 6.1epss 0.00
ezEIP v5.3.0(0649) was discovered to contain a cross-site scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in multiple features. …
- risk 0.40cvss 6.1epss 0.00
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1.
- risk 0.40cvss 6.1epss 0.02
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.
- risk 0.40cvss 6.1epss 0.01
Universal Cross Site Scripting (UXSS) vulnerability in Vimium Extension 1.66 and earlier allows remote attackers to run arbitrary code via omnibar feature.
- risk 0.40cvss 6.1epss 0.00
A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html.
- risk 0.40cvss 6.1epss 0.00
Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitization. Using this vulnerability, an authenticated attacker can execute arbitrary HTML and script code in the target…
- risk 0.40cvss 6.1epss 0.03
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets.
- risk 0.40cvss 6.1epss 0.03
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment.
- risk 0.40cvss 6.1epss 0.03
Cross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation.