CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 777 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-37161 | Med | 0.40 | 6.1 | 0.01 | Aug 25, 2022 | Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS) via SVG file upload. | ||
| CVE-2022-37153 | Med | 0.40 | 6.1 | 0.02 | Aug 24, 2022 | An issue was discovered in Artica Proxy 4.30.000000. There is a XSS vulnerability via the password parameter in /fw.login.php. | ||
| CVE-2022-38463 | Med | 0.40 | 6.1 | 0.03 | Aug 23, 2022 | ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality. | ||
| CVE-2022-38172 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2022 | ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboard. | ||
| CVE-2022-29476 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2022 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in 8 Degree Themes otification Bar for WordPress plugin <= 1.1.8 at WordPress. | ||
| CVE-2022-35278 | Med | 0.40 | 6.1 | 0.02 | Aug 23, 2022 | In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue. | ||
| CVE-2022-27637 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2022 | Reflected cross-site scripting vulnerability in PukiWiki versions 1.5.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via unspecified vectors. | ||
| CVE-2019-25075 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2022 | HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /management/users/register request. | ||
| CVE-2022-32772 | Med | 0.40 | 6.1 | 0.04 | Aug 22, 2022 | A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP… | ||
| CVE-2022-32771 | Med | 0.40 | 6.1 | 0.05 | Aug 22, 2022 | A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP… | ||
| CVE-2022-32770 | Med | 0.40 | 6.1 | 0.05 | Aug 22, 2022 | A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP… | ||
| CVE-2022-35655 | Med | 0.40 | 6.1 | 0.00 | Aug 22, 2022 | Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting. | ||
| CVE-2022-35654 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2022 | Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter. | ||
| CVE-2022-34857 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2022 | Reflected Cross-Site Scripting (XSS) vulnerability in smartypants SP Project & Document Manager plugin <= 4.59 at WordPress | ||
| CVE-2022-2532 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2022 | The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting | ||
| CVE-2022-2383 | Med | 0.40 | 6.1 | 0.06 | Aug 22, 2022 | The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting | ||
| CVE-2022-1932 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2022 | The Rezgo Online Booking WordPress plugin before 4.1.8 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting, which can be exploited either via a LFI in an AJAX action, or direct call to the affected file | ||
| CVE-2021-24910 | Med | 0.40 | 6.1 | 0.02 | Aug 22, 2022 | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response, leading to… | ||
| CVE-2022-36251 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2022 | Clinic's Patient Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via patients.php. | ||
| CVE-2022-35554 | Med | 0.40 | 6.1 | 0.01 | Aug 19, 2022 | Multiple reflected XSS vulnerabilities occur when handling error message of BPC SmartVista version 3.28.0 allowing an attacker to execute javascript code at client side. |
- risk 0.40cvss 6.1epss 0.01
Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS) via SVG file upload.
- risk 0.40cvss 6.1epss 0.02
An issue was discovered in Artica Proxy 4.30.000000. There is a XSS vulnerability via the password parameter in /fw.login.php.
- risk 0.40cvss 6.1epss 0.03
ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality.
- risk 0.40cvss 6.1epss 0.01
ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboard.
- risk 0.40cvss 6.1epss 0.01
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in 8 Degree Themes otification Bar for WordPress plugin <= 1.1.8 at WordPress.
- risk 0.40cvss 6.1epss 0.02
In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.
- risk 0.40cvss 6.1epss 0.01
Reflected cross-site scripting vulnerability in PukiWiki versions 1.5.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /management/users/register request.
- risk 0.40cvss 6.1epss 0.04
A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP…
- risk 0.40cvss 6.1epss 0.05
A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP…
- risk 0.40cvss 6.1epss 0.05
A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP…
- risk 0.40cvss 6.1epss 0.00
Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting.
- risk 0.40cvss 6.1epss 0.01
Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.
- risk 0.40cvss 6.1epss 0.01
Reflected Cross-Site Scripting (XSS) vulnerability in smartypants SP Project & Document Manager plugin <= 4.59 at WordPress
- risk 0.40cvss 6.1epss 0.01
The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.06
The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.01
The Rezgo Online Booking WordPress plugin before 4.1.8 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting, which can be exploited either via a LFI in an AJAX action, or direct call to the affected file
- risk 0.40cvss 6.1epss 0.02
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response, leading to…
- risk 0.40cvss 6.1epss 0.01
Clinic's Patient Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via patients.php.
- risk 0.40cvss 6.1epss 0.01
Multiple reflected XSS vulnerabilities occur when handling error message of BPC SmartVista version 3.28.0 allowing an attacker to execute javascript code at client side.