CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 775 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-25491 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2022 | 6Kare Emakin 5.0.341.0 is affected by Cross Site Scripting (XSS) via the /rpc/membership/setProfile DisplayName field, which is mishandled when rendering the Activity Stream page. | ||
| CVE-2022-37775 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2022 | Genesys PureConnect Interaction Web Tools Chat Service (up to at least 26- September- 2019) allows XSS within the Printable Chat History via the participant -> name JSON POST parameter. | ||
| CVE-2022-38845 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2022 | Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious JavaScript to authenticated user. Any authenticated user importing the crafted CSV file may end up… | ||
| CVE-2022-2669 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2022 | The WP Taxonomy Import WordPress plugin through 1.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting | ||
| CVE-2022-2655 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2022 | The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting | ||
| CVE-2022-2654 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2022 | The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store & Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it… | ||
| CVE-2022-29649 | Med | 0.40 | 6.1 | 0.00 | Sep 15, 2022 | Qsmart Next v4.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability. | ||
| CVE-2022-40365 | Med | 0.40 | 6.1 | 0.01 | Sep 14, 2022 | Cross site scripting (XSS) vulnerability in ouqiang gocron through 1.5.3, allows attackers to execute arbitrary code via scope.row.hostname in web/vue/src/pages/taskLog/list.vue. | ||
| CVE-2022-39799 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2022 | An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchpad, resulting in reflected cross-site scripting attack. This could lead to stealing session information and impersonating the affected user. | ||
| CVE-2022-35298 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2022 | SAP NetWeaver Enterprise Portal (KMC) - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could… | ||
| CVE-2022-38295 | Med | 0.40 | 6.1 | 0.01 | Sep 12, 2022 | Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /table_manager/view/cu_user_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Add New Group function. | ||
| CVE-2022-38291 | Med | 0.40 | 6.1 | 0.01 | Sep 12, 2022 | SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Search function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search bar. | ||
| CVE-2022-38972 | Med | 0.40 | 6.1 | 0.01 | Sep 12, 2022 | Cross-site scripting vulnerability in Movable Type plugin A-Form versions prior to 4.1.1 (for Movable Type 7 Series) and versions prior to 3.9.1 (for Movable Type 6 Series) allows a remote unauthenticated attacker to inject an arbitrary script. | ||
| CVE-2022-40325 | Med | 0.40 | 6.1 | 0.00 | Sep 11, 2022 | SysAid Help Desk before 22.1.65 allows XSS via the Asset Dashboard, aka FR# 67262. | ||
| CVE-2022-40324 | Med | 0.40 | 6.1 | 0.00 | Sep 11, 2022 | SysAid Help Desk before 22.1.65 allows XSS via the Linked SRs field, aka FR# 67258. | ||
| CVE-2022-40323 | Med | 0.40 | 6.1 | 0.00 | Sep 11, 2022 | SysAid Help Desk before 22.1.65 allows XSS in the Password Services module, aka FR# 67241. | ||
| CVE-2022-40322 | Med | 0.40 | 6.1 | 0.00 | Sep 11, 2022 | SysAid Help Desk before 22.1.65 allows XSS, aka FR# 66542 and 65579. | ||
| CVE-2022-39809 | — | Med | 0.40 | 6.1 | 0.01 | Sep 9, 2022 | An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console under /carbon/mediation_secure_vault/properties/ajaxprocessor.jsp via the name parameter. Session hijacking or similar… | |
| CVE-2022-3148 | Med | 0.40 | 6.1 | 0.01 | Sep 8, 2022 | Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0. | ||
| CVE-2022-3138 | Med | 0.40 | 6.1 | 0.01 | Sep 8, 2022 | Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0. |
- risk 0.40cvss 6.1epss 0.01
6Kare Emakin 5.0.341.0 is affected by Cross Site Scripting (XSS) via the /rpc/membership/setProfile DisplayName field, which is mishandled when rendering the Activity Stream page.
- risk 0.40cvss 6.1epss 0.01
Genesys PureConnect Interaction Web Tools Chat Service (up to at least 26- September- 2019) allows XSS within the Printable Chat History via the participant -> name JSON POST parameter.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious JavaScript to authenticated user. Any authenticated user importing the crafted CSV file may end up…
- risk 0.40cvss 6.1epss 0.01
The WP Taxonomy Import WordPress plugin through 1.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.01
The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.01
The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store & Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it…
- risk 0.40cvss 6.1epss 0.00
Qsmart Next v4.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
Cross site scripting (XSS) vulnerability in ouqiang gocron through 1.5.3, allows attackers to execute arbitrary code via scope.row.hostname in web/vue/src/pages/taskLog/list.vue.
- risk 0.40cvss 6.1epss 0.01
An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchpad, resulting in reflected cross-site scripting attack. This could lead to stealing session information and impersonating the affected user.
- risk 0.40cvss 6.1epss 0.01
SAP NetWeaver Enterprise Portal (KMC) - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could…
- risk 0.40cvss 6.1epss 0.01
Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /table_manager/view/cu_user_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Add New Group function.
- risk 0.40cvss 6.1epss 0.01
SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Search function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search bar.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Movable Type plugin A-Form versions prior to 4.1.1 (for Movable Type 7 Series) and versions prior to 3.9.1 (for Movable Type 6 Series) allows a remote unauthenticated attacker to inject an arbitrary script.
- risk 0.40cvss 6.1epss 0.00
SysAid Help Desk before 22.1.65 allows XSS via the Asset Dashboard, aka FR# 67262.
- risk 0.40cvss 6.1epss 0.00
SysAid Help Desk before 22.1.65 allows XSS via the Linked SRs field, aka FR# 67258.
- risk 0.40cvss 6.1epss 0.00
SysAid Help Desk before 22.1.65 allows XSS in the Password Services module, aka FR# 67241.
- risk 0.40cvss 6.1epss 0.00
SysAid Help Desk before 22.1.65 allows XSS, aka FR# 66542 and 65579.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console under /carbon/mediation_secure_vault/properties/ajaxprocessor.jsp via the name parameter. Session hijacking or similar…
- risk 0.40cvss 6.1epss 0.01
Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.
- risk 0.40cvss 6.1epss 0.01
Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.