CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 784 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-30118 | Med | 0.40 | 6.1 | 0.01 | Jun 24, 2022 | Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description: When using Internet Explorer with the XSS protection disabled, editing a form control in an express entities form for Concrete 8.5.7 and below as well as Concrete… | ||
| CVE-2022-34328 | Med | 0.40 | 6.1 | 0.02 | Jun 23, 2022 | PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=author_see request to index.php. | ||
| CVE-2022-32131 | Med | 0.40 | 6.1 | 0.01 | Jun 23, 2022 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /index/notice/show. | ||
| CVE-2022-32130 | Med | 0.40 | 6.1 | 0.01 | Jun 23, 2022 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/down_resume/total/nature. | ||
| CVE-2022-32129 | Med | 0.40 | 6.1 | 0.01 | Jun 23, 2022 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/account/safety/trade. | ||
| CVE-2022-32128 | Med | 0.40 | 6.1 | 0.01 | Jun 23, 2022 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/service/increment/add/im. | ||
| CVE-2022-32127 | Med | 0.40 | 6.1 | 0.01 | Jun 23, 2022 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/view_be_browsed/total. | ||
| CVE-2022-32126 | Med | 0.40 | 6.1 | 0.01 | Jun 23, 2022 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company. | ||
| CVE-2022-32125 | Med | 0.40 | 6.1 | 0.01 | Jun 23, 2022 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /job. | ||
| CVE-2022-32124 | Med | 0.40 | 6.1 | 0.01 | Jun 23, 2022 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /index/jobfairol/show/. | ||
| CVE-2021-29055 | Med | 0.40 | 6.1 | 0.01 | Jun 23, 2022 | Cross Site Scripting (XSS) vulnerability in sourcecodester School File Management System 1.0 via the Firtstname parameter to the Update Account form in student_profile.php. | ||
| CVE-2022-34305 | Med | 0.40 | 6.1 | 0.07 | Jun 23, 2022 | In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability. | ||
| CVE-2022-23077 | Med | 0.40 | 6.1 | 0.01 | Jun 22, 2022 | In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page. | ||
| CVE-2022-31786 | Med | 0.40 | 6.1 | 0.01 | Jun 21, 2022 | IdeaLMS 2022 allows reflected Cross Site Scripting (XSS) via the IdeaLMS/Class/Assessment/ PATH_INFO. | ||
| CVE-2021-41924 | Med | 0.40 | 6.1 | 0.01 | Jun 21, 2022 | Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS). | ||
| CVE-2022-33119 | Med | 0.40 | 6.1 | 0.02 | Jun 21, 2022 | NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php. | ||
| CVE-2022-31373 | Med | 0.40 | 6.1 | 0.06 | Jun 21, 2022 | SolarView Compact v6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Solar_AiConf.php. | ||
| CVE-2021-25104 | Med | 0.40 | 6.1 | 0.01 | Jun 20, 2022 | The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue | ||
| CVE-2022-31734 | Med | 0.40 | 6.1 | 0.01 | Jun 20, 2022 | Cisco Catalyst 2940 Series Switches provided by Cisco Systems, Inc. contain a reflected cross-site scripting vulnerability regarding error page generation. An arbitrary script may be executed on the web browser of the user who is using the product. The affected firmware is prior… | ||
| CVE-2022-31875 | Med | 0.40 | 6.1 | 0.01 | Jun 17, 2022 | Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68) has an xss vulnerability via the proname parameter in /admin/scheprofile.cgi |
- risk 0.40cvss 6.1epss 0.01
Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description: When using Internet Explorer with the XSS protection disabled, editing a form control in an express entities form for Concrete 8.5.7 and below as well as Concrete…
- risk 0.40cvss 6.1epss 0.02
PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=author_see request to index.php.
- risk 0.40cvss 6.1epss 0.01
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /index/notice/show.
- risk 0.40cvss 6.1epss 0.01
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/down_resume/total/nature.
- risk 0.40cvss 6.1epss 0.01
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/account/safety/trade.
- risk 0.40cvss 6.1epss 0.01
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/service/increment/add/im.
- risk 0.40cvss 6.1epss 0.01
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/view_be_browsed/total.
- risk 0.40cvss 6.1epss 0.01
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company.
- risk 0.40cvss 6.1epss 0.01
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /job.
- risk 0.40cvss 6.1epss 0.01
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /index/jobfairol/show/.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability in sourcecodester School File Management System 1.0 via the Firtstname parameter to the Update Account form in student_profile.php.
- risk 0.40cvss 6.1epss 0.07
In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
- risk 0.40cvss 6.1epss 0.01
In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page.
- risk 0.40cvss 6.1epss 0.01
IdeaLMS 2022 allows reflected Cross Site Scripting (XSS) via the IdeaLMS/Class/Assessment/ PATH_INFO.
- risk 0.40cvss 6.1epss 0.01
Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.02
NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php.
- risk 0.40cvss 6.1epss 0.06
SolarView Compact v6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Solar_AiConf.php.
- risk 0.40cvss 6.1epss 0.01
The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue
- risk 0.40cvss 6.1epss 0.01
Cisco Catalyst 2940 Series Switches provided by Cisco Systems, Inc. contain a reflected cross-site scripting vulnerability regarding error page generation. An arbitrary script may be executed on the web browser of the user who is using the product. The affected firmware is prior…
- risk 0.40cvss 6.1epss 0.01
Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68) has an xss vulnerability via the proname parameter in /admin/scheprofile.cgi