CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 761 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-23073 | Med | 0.40 | 6.1 | 0.03 | Feb 1, 2023 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component. | ||
| CVE-2022-46934 | Med | 0.40 | 6.1 | 0.01 | Feb 1, 2023 | kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java. | ||
| CVE-2022-47701 | Med | 0.40 | 6.1 | 0.00 | Jan 31, 2023 | COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSS). | ||
| CVE-2022-47698 | Med | 0.40 | 6.1 | 0.00 | Jan 31, 2023 | COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSS) via the URL filtering feature in the router. | ||
| CVE-2022-44897 | Med | 0.40 | 6.1 | 0.01 | Jan 31, 2023 | A cross-site scripting (XSS) vulnerability in ApolloTheme AP PageBuilder component through 2.4.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the show_number parameter. | ||
| CVE-2023-22333 | Med | 0.40 | 6.1 | 0.01 | Jan 30, 2023 | Cross-site scripting vulnerability in EasyMail 2.00.130 and earlier allows a remote unauthenticated attacker to inject an arbitrary script. | ||
| CVE-2022-39813 | Med | 0.40 | 6.1 | 0.00 | Jan 27, 2023 | Italtel NetMatch-S CI 5.2.0-20211008 allows Multiple Reflected/Stored XSS issues under NMSCIWebGui/j_security_check via the j_username parameter, or NMSCIWebGui/actloglineview.jsp via the name or actLine parameter. An attacker leveraging this vulnerability could inject arbitrary… | ||
| CVE-2022-48118 | Med | 0.40 | 6.1 | 0.00 | Jan 27, 2023 | Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter. | ||
| CVE-2022-48012 | Med | 0.40 | 6.1 | 0.01 | Jan 27, 2023 | Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd. | ||
| CVE-2022-44029 | Med | 0.40 | 6.1 | 0.00 | Jan 27, 2023 | An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 6 of 6. | ||
| CVE-2022-44028 | Med | 0.40 | 6.1 | 0.00 | Jan 27, 2023 | An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 5 of 6. | ||
| CVE-2022-44027 | Med | 0.40 | 6.1 | 0.00 | Jan 27, 2023 | An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 4 of 6. | ||
| CVE-2022-44026 | Med | 0.40 | 6.1 | 0.00 | Jan 27, 2023 | An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 3 of 6. | ||
| CVE-2022-44025 | Med | 0.40 | 6.1 | 0.00 | Jan 27, 2023 | An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 2 of 6. | ||
| CVE-2022-44024 | Med | 0.40 | 6.1 | 0.00 | Jan 27, 2023 | An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 1 of 6. | ||
| CVE-2023-23951 | Med | 0.40 | 6.1 | 0.01 | Jan 26, 2023 | Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application | ||
| CVE-2023-23950 | Med | 0.40 | 6.1 | 0.01 | Jan 26, 2023 | User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses. | ||
| CVE-2023-22971 | Med | 0.40 | 6.1 | 0.01 | Jan 26, 2023 | Cross Site Scripting (XSS) vulnerability in Hughes Network Systems Router Terminal for HX200 v8.3.1.14, HX90 v6.11.0.5, HX50L v6.10.0.18, HN9460 v8.2.0.48, and HN7000S v6.9.0.37, allows unauthenticated attackers to misuse frames, include JS/HTML code and steal sensitive… | ||
| CVE-2023-22725 | Med | 0.40 | 6.2 | 0.01 | Jan 26, 2023 | GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 are vulnerable to Cross-site Scripting. This vulnerability allow for an administrator to create a malicious external link. This issue is patched in 10.0.6. | ||
| CVE-2023-22724 | Med | 0.40 | 6.2 | 0.01 | Jan 26, 2023 | GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting (XSS) payloads inside RSS links. Victims who wish to… |
- risk 0.40cvss 6.1epss 0.03
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component.
- risk 0.40cvss 6.1epss 0.01
kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java.
- risk 0.40cvss 6.1epss 0.00
COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.00
COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSS) via the URL filtering feature in the router.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in ApolloTheme AP PageBuilder component through 2.4.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the show_number parameter.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in EasyMail 2.00.130 and earlier allows a remote unauthenticated attacker to inject an arbitrary script.
- risk 0.40cvss 6.1epss 0.00
Italtel NetMatch-S CI 5.2.0-20211008 allows Multiple Reflected/Stored XSS issues under NMSCIWebGui/j_security_check via the j_username parameter, or NMSCIWebGui/actloglineview.jsp via the name or actLine parameter. An attacker leveraging this vulnerability could inject arbitrary…
- risk 0.40cvss 6.1epss 0.00
Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter.
- risk 0.40cvss 6.1epss 0.01
Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 6 of 6.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 5 of 6.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 4 of 6.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 3 of 6.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 2 of 6.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 1 of 6.
- risk 0.40cvss 6.1epss 0.01
Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application
- risk 0.40cvss 6.1epss 0.01
User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability in Hughes Network Systems Router Terminal for HX200 v8.3.1.14, HX90 v6.11.0.5, HX50L v6.10.0.18, HN9460 v8.2.0.48, and HN7000S v6.9.0.37, allows unauthenticated attackers to misuse frames, include JS/HTML code and steal sensitive…
- risk 0.40cvss 6.2epss 0.01
GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 are vulnerable to Cross-site Scripting. This vulnerability allow for an administrator to create a malicious external link. This issue is patched in 10.0.6.
- risk 0.40cvss 6.2epss 0.01
GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting (XSS) payloads inside RSS links. Victims who wish to…