CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 786 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-1604 | Med | 0.40 | 6.1 | 0.01 | Jun 13, 2022 | The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting | ||
| CVE-2022-1532 | Med | 0.40 | 6.1 | 0.01 | Jun 13, 2022 | Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting | ||
| CVE-2022-0626 | Med | 0.40 | 6.1 | 0.01 | Jun 13, 2022 | The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting. | ||
| CVE-2022-27231 | Med | 0.40 | 6.1 | 0.01 | Jun 13, 2022 | Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the website using… | ||
| CVE-2021-44266 | Med | 0.40 | 6.1 | 0.01 | Jun 11, 2022 | GUnet Open eClass (aka openeclass) before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter. | ||
| CVE-2022-31402 | Med | 0.40 | 6.1 | 0.02 | Jun 10, 2022 | ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/webservices/export-v2.php. | ||
| CVE-2022-2035 | Med | 0.40 | 6.1 | 0.01 | Jun 9, 2022 | A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORM Engine versions < 20.1.45.914, 21.1.x < 21.1.7.219. The issue exists because there are no limitations on the domain or format of the url… | ||
| CVE-2022-32195 | Med | 0.40 | 6.1 | 0.02 | Jun 9, 2022 | Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL. | ||
| CVE-2022-30875 | Med | 0.40 | 6.1 | 0.01 | Jun 8, 2022 | Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page. | ||
| CVE-2022-31497 | Med | 0.40 | 6.1 | 0.01 | Jun 8, 2022 | LibreHealth EHR Base 2.0.0 allows interface/main/finder/finder_navigation.php patient XSS. | ||
| CVE-2022-1673 | Med | 0.40 | 6.1 | 0.01 | Jun 8, 2022 | The WooCommerce Green Wallet Gateway WordPress plugin before 1.0.2 does not escape the error_envision query parameter before outputting it to the page, leading to a Reflected Cross-Site Scripting vulnerability. | ||
| CVE-2022-1597 | Med | 0.40 | 6.1 | 0.03 | Jun 8, 2022 | The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks | ||
| CVE-2022-1241 | Med | 0.40 | 6.1 | 0.01 | Jun 8, 2022 | The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Reflected Cross-Site Scripting issues | ||
| CVE-2022-31495 | Med | 0.40 | 6.1 | 0.01 | Jun 7, 2022 | LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php return_page XSS. | ||
| CVE-2022-31494 | Med | 0.40 | 6.1 | 0.01 | Jun 6, 2022 | LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php action XSS. | ||
| CVE-2022-31498 | Med | 0.40 | 6.1 | 0.01 | Jun 6, 2022 | LibreHealth EHR Base 2.0.0 allows interface/orders/patient_match_dialog.php key XSS. | ||
| CVE-2022-31492 | Med | 0.40 | 6.1 | 0.01 | Jun 6, 2022 | Cross Site scripting (XSS) vulnerability inLibreHealth EHR Base 2.0.0 via interface/usergroup/usergroup_admin_add.php Username. | ||
| CVE-2022-31493 | Med | 0.40 | 6.1 | 0.01 | Jun 6, 2022 | LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php acl_id XSS. | ||
| CVE-2021-42245 | Med | 0.40 | 6.1 | 0.01 | Jun 6, 2022 | FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections. | ||
| CVE-2022-30514 | Med | 0.40 | 6.1 | 0.04 | Jun 2, 2022 | School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.php:126. |
- risk 0.40cvss 6.1epss 0.01
The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.01
Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.01
The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the website using…
- risk 0.40cvss 6.1epss 0.01
GUnet Open eClass (aka openeclass) before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter.
- risk 0.40cvss 6.1epss 0.02
ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/webservices/export-v2.php.
- risk 0.40cvss 6.1epss 0.01
A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORM Engine versions < 20.1.45.914, 21.1.x < 21.1.7.219. The issue exists because there are no limitations on the domain or format of the url…
- risk 0.40cvss 6.1epss 0.02
Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL.
- risk 0.40cvss 6.1epss 0.01
Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page.
- risk 0.40cvss 6.1epss 0.01
LibreHealth EHR Base 2.0.0 allows interface/main/finder/finder_navigation.php patient XSS.
- risk 0.40cvss 6.1epss 0.01
The WooCommerce Green Wallet Gateway WordPress plugin before 1.0.2 does not escape the error_envision query parameter before outputting it to the page, leading to a Reflected Cross-Site Scripting vulnerability.
- risk 0.40cvss 6.1epss 0.03
The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks
- risk 0.40cvss 6.1epss 0.01
The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Reflected Cross-Site Scripting issues
- risk 0.40cvss 6.1epss 0.01
LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php return_page XSS.
- risk 0.40cvss 6.1epss 0.01
LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php action XSS.
- risk 0.40cvss 6.1epss 0.01
LibreHealth EHR Base 2.0.0 allows interface/orders/patient_match_dialog.php key XSS.
- risk 0.40cvss 6.1epss 0.01
Cross Site scripting (XSS) vulnerability inLibreHealth EHR Base 2.0.0 via interface/usergroup/usergroup_admin_add.php Username.
- risk 0.40cvss 6.1epss 0.01
LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php acl_id XSS.
- risk 0.40cvss 6.1epss 0.01
FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections.
- risk 0.40cvss 6.1epss 0.04
School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.php:126.