CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 762 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-46957 | Med | 0.40 | 6.1 | 0.01 | Jan 26, 2023 | Sourcecodester.com Online Graduate Tracer System V 1.0.0 is vulnerable to Cross Site Scripting (XSS). | ||
| CVE-2022-46624 | Med | 0.40 | 6.1 | 0.00 | Jan 26, 2023 | A cross-site scripting (XSS) vulnerability in Online Graduate Tracer System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter. | ||
| CVE-2022-46128 | Med | 0.40 | 6.1 | 0.00 | Jan 26, 2023 | phpgurukul Doctor Appointment Management System V 1.0.0 is vulnerable to Cross Site Scripting (XSS) via searchdata=. | ||
| CVE-2022-45730 | Med | 0.40 | 6.1 | 0.01 | Jan 26, 2023 | A cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search function. | ||
| CVE-2022-41941 | Med | 0.40 | 6.2 | 0.01 | Jan 26, 2023 | GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6. | ||
| CVE-2020-22327 | Med | 0.40 | 6.1 | 0.01 | Jan 26, 2023 | An issue was discovered in HFish 0.5.1. When a payload is inserted where the name is entered, XSS code is triggered when the administrator views the information. | ||
| CVE-2021-43446 | Med | 0.40 | 6.1 | 0.01 | Jan 23, 2023 | ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the document editor allows malicious cross site scripting payloads to be used. | ||
| CVE-2023-24070 | Med | 0.40 | 6.1 | 0.00 | Jan 23, 2023 | app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field. | ||
| CVE-2023-24027 | Med | 0.40 | 6.1 | 0.00 | Jan 20, 2023 | In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name. | ||
| CVE-2023-24026 | Med | 0.40 | 6.1 | 0.00 | Jan 20, 2023 | In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload. | ||
| CVE-2023-23491 | Med | 0.40 | 6.1 | 0.01 | Jan 20, 2023 | The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qem_ajax_calendar' action. | ||
| CVE-2023-23024 | Med | 0.40 | 6.1 | 0.00 | Jan 20, 2023 | Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the writer parameter. | ||
| CVE-2023-23015 | Med | 0.40 | 6.1 | 0.00 | Jan 20, 2023 | Cross Site Scripting (XSS) vulnerability in Kalkun 0.8.0 via username input in file User_model.php. | ||
| CVE-2023-23014 | Med | 0.40 | 6.1 | 0.00 | Jan 20, 2023 | Cross Site Scripting (XSS) vulnerability in InventorySystem thru commit e08fbbe17902146313501ed0b5feba81d58f455c (on Apr 23, 2021) via edit_store_name and edit_active inputs in file InventorySystem.php. | ||
| CVE-2023-23012 | Med | 0.40 | 6.1 | 0.00 | Jan 20, 2023 | Cross Site Scripting (XSS) vulnerability in craigrodway classroombookings 2.6.4 allows attackers to execute arbitrary code or other unspecified impacts via the input bgcol in file Weeks.php. | ||
| CVE-2023-23010 | Med | 0.40 | 6.1 | 0.01 | Jan 20, 2023 | Cross Site Scripting (XSS) vulnerability in Ecommerce-CodeIgniter-Bootstrap thru commit d5904379ca55014c5df34c67deda982c73dc7fe5 (on Dec 27, 2022), allows attackers to execute arbitrary code via the languages and trans_load parameters in file add_product.php. | ||
| CVE-2022-45558 | Med | 0.40 | 6.1 | 0.00 | Jan 20, 2023 | Cross site scripting (XSS) vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via the meta tag. | ||
| CVE-2022-45557 | Med | 0.40 | 6.1 | 0.00 | Jan 20, 2023 | Cross site scripting (XSS) vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via file names. | ||
| CVE-2022-45541 | Med | 0.40 | 6.1 | 0.00 | Jan 20, 2023 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article attribute editor component in POST value "value" if the value contains a non-integer char. | ||
| CVE-2022-45540 | Med | 0.40 | 6.1 | 0.00 | Jan 20, 2023 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in article type editor component in POST value "name" if the value contains a malformed UTF-8 char. |
- risk 0.40cvss 6.1epss 0.01
Sourcecodester.com Online Graduate Tracer System V 1.0.0 is vulnerable to Cross Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.00
A cross-site scripting (XSS) vulnerability in Online Graduate Tracer System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.
- risk 0.40cvss 6.1epss 0.00
phpgurukul Doctor Appointment Management System V 1.0.0 is vulnerable to Cross Site Scripting (XSS) via searchdata=.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search function.
- risk 0.40cvss 6.2epss 0.01
GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in HFish 0.5.1. When a payload is inserted where the name is entered, XSS code is triggered when the administrator views the information.
- risk 0.40cvss 6.1epss 0.01
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the document editor allows malicious cross site scripting payloads to be used.
- risk 0.40cvss 6.1epss 0.00
app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field.
- risk 0.40cvss 6.1epss 0.00
In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name.
- risk 0.40cvss 6.1epss 0.00
In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.
- risk 0.40cvss 6.1epss 0.01
The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qem_ajax_calendar' action.
- risk 0.40cvss 6.1epss 0.00
Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the writer parameter.
- risk 0.40cvss 6.1epss 0.00
Cross Site Scripting (XSS) vulnerability in Kalkun 0.8.0 via username input in file User_model.php.
- risk 0.40cvss 6.1epss 0.00
Cross Site Scripting (XSS) vulnerability in InventorySystem thru commit e08fbbe17902146313501ed0b5feba81d58f455c (on Apr 23, 2021) via edit_store_name and edit_active inputs in file InventorySystem.php.
- risk 0.40cvss 6.1epss 0.00
Cross Site Scripting (XSS) vulnerability in craigrodway classroombookings 2.6.4 allows attackers to execute arbitrary code or other unspecified impacts via the input bgcol in file Weeks.php.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability in Ecommerce-CodeIgniter-Bootstrap thru commit d5904379ca55014c5df34c67deda982c73dc7fe5 (on Dec 27, 2022), allows attackers to execute arbitrary code via the languages and trans_load parameters in file add_product.php.
- risk 0.40cvss 6.1epss 0.00
Cross site scripting (XSS) vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via the meta tag.
- risk 0.40cvss 6.1epss 0.00
Cross site scripting (XSS) vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via file names.
- risk 0.40cvss 6.1epss 0.00
EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article attribute editor component in POST value "value" if the value contains a non-integer char.
- risk 0.40cvss 6.1epss 0.00
EyouCMS <= 1.6.0 was discovered a reflected-XSS in article type editor component in POST value "name" if the value contains a malformed UTF-8 char.