CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 782 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-1951 | Med | 0.40 | 6.1 | 0.01 | Jul 11, 2022 | The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active,… | ||
| CVE-2022-1937 | Med | 0.40 | 6.1 | 0.02 | Jul 11, 2022 | The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting | ||
| CVE-2022-1910 | Med | 0.40 | 6.1 | 0.01 | Jul 11, 2022 | The Shortcodes and extra features for Phlox WordPress plugin before 2.9.8 does not sanitise and escape a parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting | ||
| CVE-2022-1546 | Med | 0.40 | 6.1 | 0.01 | Jul 11, 2022 | The WooCommerce - Product Importer WordPress plugin through 1.5.2 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting | ||
| CVE-2022-1474 | Med | 0.40 | 6.1 | 0.01 | Jul 11, 2022 | The WP Event Manager WordPress plugin before 3.1.28 does not sanitise and escape its search before outputting it back in an attribute on the event dashboard, leading to a Reflected Cross-Site Scripting | ||
| CVE-2022-1220 | Med | 0.40 | 6.1 | 0.01 | Jul 11, 2022 | The FoxyShop WordPress plugin before 4.8.2 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting | ||
| CVE-2022-35416 | — | Med | 0.40 | 6.1 | 0.03 | Jul 11, 2022 | H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS. | |
| CVE-2022-27168 | Med | 0.40 | 6.1 | 0.01 | Jul 11, 2022 | Cross-site scripting vulnerability in LiteCart versions prior to 2.4.2 allows a remote attacker to inject an arbitrary script via unspecified vectors. | ||
| CVE-2022-27910 | Med | 0.40 | 6.1 | 0.01 | Jul 10, 2022 | In Joomla component 'Joomlatools - DOCman 3.5.13 (and likely most versions below)' are affected to an reflected Cross-Site Scripting (XSS) in an image upload function | ||
| CVE-2021-44791 | Med | 0.40 | 6.1 | 0.02 | Jul 7, 2022 | In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks. | ||
| CVE-2022-34007 | Med | 0.40 | 6.1 | 0.02 | Jul 7, 2022 | EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry. | ||
| CVE-2022-20815 | Med | 0.40 | 6.1 | 0.01 | Jul 6, 2022 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an… | ||
| CVE-2022-20800 | Med | 0.40 | 6.1 | 0.01 | Jul 6, 2022 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), and… | ||
| CVE-2022-23713 | Med | 0.40 | 6.1 | 0.01 | Jul 6, 2022 | A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victim’s browser. | ||
| CVE-2021-31676 | Med | 0.40 | 6.1 | 0.01 | Jul 6, 2022 | A reflected XSS was discovered in PESCMS-V2.3.3. When combined with CSRF in the same file, they can cause bigger destruction. | ||
| CVE-2021-45721 | Med | 0.40 | 6.1 | 0.01 | Jul 6, 2022 | JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API endpoint. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.36.1 versions prior to… | ||
| CVE-2022-1946 | Med | 0.40 | 6.1 | 0.02 | Jul 4, 2022 | The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue | ||
| CVE-2022-0250 | Med | 0.40 | 6.1 | 0.02 | Jul 4, 2022 | The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting | ||
| CVE-2022-27627 | Med | 0.40 | 6.1 | 0.01 | Jul 4, 2022 | Cross-site scripting vulnerability in Organization's Information of Cybozu Garoon 4.10.2 to 5.5.1 allows a remote attacker to execute an arbitrary script on the logged-in user's web browser. | ||
| CVE-2022-2290 | Med | 0.40 | 6.1 | 0.03 | Jul 3, 2022 | Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta. |
- risk 0.40cvss 6.1epss 0.01
The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active,…
- risk 0.40cvss 6.1epss 0.02
The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.01
The Shortcodes and extra features for Phlox WordPress plugin before 2.9.8 does not sanitise and escape a parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.01
The WooCommerce - Product Importer WordPress plugin through 1.5.2 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.01
The WP Event Manager WordPress plugin before 3.1.28 does not sanitise and escape its search before outputting it back in an attribute on the event dashboard, leading to a Reflected Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.01
The FoxyShop WordPress plugin before 4.8.2 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.03
H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in LiteCart versions prior to 2.4.2 allows a remote attacker to inject an arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
In Joomla component 'Joomlatools - DOCman 3.5.13 (and likely most versions below)' are affected to an reflected Cross-Site Scripting (XSS) in an image upload function
- risk 0.40cvss 6.1epss 0.02
In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks.
- risk 0.40cvss 6.1epss 0.02
EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry.
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), and…
- risk 0.40cvss 6.1epss 0.01
A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victim’s browser.
- risk 0.40cvss 6.1epss 0.01
A reflected XSS was discovered in PESCMS-V2.3.3. When combined with CSRF in the same file, they can cause bigger destruction.
- risk 0.40cvss 6.1epss 0.01
JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API endpoint. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.36.1 versions prior to…
- risk 0.40cvss 6.1epss 0.02
The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
- risk 0.40cvss 6.1epss 0.02
The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Organization's Information of Cybozu Garoon 4.10.2 to 5.5.1 allows a remote attacker to execute an arbitrary script on the logged-in user's web browser.
- risk 0.40cvss 6.1epss 0.03
Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta.