CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 769 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-44787 | Med | 0.40 | 6.1 | 0.00 | Nov 21, 2022 | An issue was discovered in Appalti & Contratti 9.12.2. The web applications are vulnerable to a Reflected Cross-Site Scripting issue. The idPagina parameter is reflected inside the server response without any HTML encoding, resulting in XSS when the victim moves the mouse… | ||
| CVE-2022-41615 | Med | 0.40 | 6.1 | 0.00 | Nov 18, 2022 | Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress. | ||
| CVE-2021-31739 | Med | 0.40 | 6.1 | 0.00 | Nov 18, 2022 | The SEPPmail solution is vulnerable to a Cross-Site Scripting vulnerability (XSS), because user input is not correctly encoded in HTML attributes when returned by the server.SEPPmail 11.1.10 allows XSS via a recipient address. | ||
| CVE-2022-38075 | Med | 0.40 | 6.1 | 0.00 | Nov 18, 2022 | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress. | ||
| CVE-2022-43332 | Med | 0.40 | 6.1 | 0.01 | Nov 17, 2022 | A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Site title field of the Configuration Panel. | ||
| CVE-2022-41132 | Med | 0.40 | 6.1 | 0.00 | Nov 17, 2022 | Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress. | ||
| CVE-2022-39181 | Med | 0.40 | 6.1 | 0.00 | Nov 17, 2022 | GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting (RXSS). Type 1: Reflected XSS (or Non-Persistent) - The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a victim to… | ||
| CVE-2022-36357 | Med | 0.40 | 6.1 | 0.00 | Nov 17, 2022 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Webpsilon ULTIMATE TABLES plugin <= 1.6.5 versions. | ||
| CVE-2022-43142 | Med | 0.40 | 6.1 | 0.00 | Nov 17, 2022 | A cross-site scripting (XSS) vulnerability in the add-fee.php component of Password Storage Application v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cmddept parameter. | ||
| CVE-2022-42187 | Med | 0.40 | 6.1 | 0.00 | Nov 17, 2022 | Hustoj 22.09.22 has a XSS Vulnerability in /admin/problem_judge.php. | ||
| CVE-2022-44002 | Med | 0.40 | 6.1 | 0.00 | Nov 16, 2022 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to insufficient output encoding of user-supplied data, the web application is vulnerable to cross-site scripting (XSS) at various locations. | ||
| CVE-2022-43263 | Med | 0.40 | 6.1 | 0.01 | Nov 16, 2022 | A cross-site scripting (XSS) vulnerability in Arobas Music Guitar Pro for iPad and iPhone before v1.10.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the name of an uploaded file. | ||
| CVE-2022-38167 | Med | 0.40 | 6.1 | 0.00 | Nov 14, 2022 | The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS. | ||
| CVE-2021-40272 | — | Med | 0.40 | 6.1 | 0.01 | Nov 14, 2022 | OP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS). | |
| CVE-2022-3578 | Med | 0.40 | 6.1 | 0.01 | Nov 14, 2022 | The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting | ||
| CVE-2022-3484 | Med | 0.40 | 6.1 | 0.01 | Nov 14, 2022 | The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. | ||
| CVE-2022-3415 | Med | 0.40 | 6.1 | 0.01 | Nov 14, 2022 | The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin view the related contact message | ||
| CVE-2022-35740 | Med | 0.40 | 6.1 | 0.01 | Nov 10, 2022 | dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. (This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users.) Some Java application frameworks,… | ||
| CVE-2021-40289 | Med | 0.40 | 6.1 | 0.01 | Nov 10, 2022 | mm-wki v0.2.1 is vulnerable to Cross Site Scripting (XSS). | ||
| CVE-2022-31688 | Med | 0.40 | 6.1 | 0.00 | Nov 9, 2022 | VMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window. |
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in Appalti & Contratti 9.12.2. The web applications are vulnerable to a Reflected Cross-Site Scripting issue. The idPagina parameter is reflected inside the server response without any HTML encoding, resulting in XSS when the victim moves the mouse…
- risk 0.40cvss 6.1epss 0.00
Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress.
- risk 0.40cvss 6.1epss 0.00
The SEPPmail solution is vulnerable to a Cross-Site Scripting vulnerability (XSS), because user input is not correctly encoded in HTML attributes when returned by the server.SEPPmail 11.1.10 allows XSS via a recipient address.
- risk 0.40cvss 6.1epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Site title field of the Configuration Panel.
- risk 0.40cvss 6.1epss 0.00
Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress.
- risk 0.40cvss 6.1epss 0.00
GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting (RXSS). Type 1: Reflected XSS (or Non-Persistent) - The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a victim to…
- risk 0.40cvss 6.1epss 0.00
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Webpsilon ULTIMATE TABLES plugin <= 1.6.5 versions.
- risk 0.40cvss 6.1epss 0.00
A cross-site scripting (XSS) vulnerability in the add-fee.php component of Password Storage Application v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cmddept parameter.
- risk 0.40cvss 6.1epss 0.00
Hustoj 22.09.22 has a XSS Vulnerability in /admin/problem_judge.php.
- risk 0.40cvss 6.1epss 0.00
An issue was discovered in BACKCLICK Professional 5.9.63. Due to insufficient output encoding of user-supplied data, the web application is vulnerable to cross-site scripting (XSS) at various locations.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in Arobas Music Guitar Pro for iPad and iPhone before v1.10.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the name of an uploaded file.
- risk 0.40cvss 6.1epss 0.00
The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS.
- risk 0.40cvss 6.1epss 0.01
OP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.01
The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.01
The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- risk 0.40cvss 6.1epss 0.01
The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin view the related contact message
- risk 0.40cvss 6.1epss 0.01
dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. (This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users.) Some Java application frameworks,…
- risk 0.40cvss 6.1epss 0.01
mm-wki v0.2.1 is vulnerable to Cross Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.00
VMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window.