CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 795 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-1168 | Med | 0.40 | 6.1 | 0.02 | Apr 4, 2022 | There is a Cross-Site Scripting vulnerability in the JobSearch WP JobSearch WordPress plugin before 1.5.1. | ||
| CVE-2022-1167 | Med | 0.40 | 6.1 | 0.01 | Apr 4, 2022 | There are unauthenticated reflected Cross-Site Scripting (XSS) vulnerabilities in CareerUp Careerup WordPress theme before 2.3.1, via the filter parameters. | ||
| CVE-2022-1164 | Med | 0.40 | 6.1 | 0.01 | Apr 4, 2022 | The Wyzi Theme was affected by reflected XSS vulnerabilities in the business search feature | ||
| CVE-2022-0901 | Med | 0.40 | 6.1 | 0.04 | Apr 4, 2022 | The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters | ||
| CVE-2022-0864 | Med | 0.40 | 6.1 | 0.07 | Apr 4, 2022 | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2022-0431 | Med | 0.40 | 6.1 | 0.01 | Apr 4, 2022 | The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting | ||
| CVE-2022-26616 | Med | 0.40 | 6.1 | 0.01 | Apr 4, 2022 | PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting (XSS) attacks via crafted HTTP headers. | ||
| CVE-2022-21830 | Med | 0.40 | 6.1 | 0.01 | Apr 1, 2022 | A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance. | ||
| CVE-2021-43707 | Med | 0.40 | 6.1 | 0.01 | Mar 31, 2022 | Cross Site Scripting (XSS) vulnerability exists in Maccms v10 via link_Name parameter. | ||
| CVE-2022-27496 | Med | 0.40 | 6.1 | 0.01 | Mar 31, 2022 | Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors. | ||
| CVE-2021-20729 | Med | 0.40 | 6.1 | 0.03 | Mar 31, 2022 | Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a remote attacker to inject an arbitrary script via a malicious URL. | ||
| CVE-2021-43661 | Med | 0.40 | 6.1 | 0.01 | Mar 31, 2022 | totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /home.asp. | ||
| CVE-2022-26644 | Med | 0.40 | 6.1 | 0.01 | Mar 30, 2022 | Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via parameters on user profile, system_info and accounts management. | ||
| CVE-2022-24135 | Med | 0.40 | 6.1 | 0.01 | Mar 30, 2022 | QingScan 1.3.0 is affected by Cross Site Scripting (XSS) vulnerability in all search functions. | ||
| CVE-2022-23801 | Med | 0.40 | 6.1 | 0.01 | Mar 30, 2022 | An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in com_media. | ||
| CVE-2022-23800 | Med | 0.40 | 6.1 | 0.01 | Mar 30, 2022 | An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components. | ||
| CVE-2022-23796 | Med | 0.40 | 6.1 | 0.01 | Mar 30, 2022 | An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using com_fields. | ||
| CVE-2022-24131 | Med | 0.40 | 6.1 | 0.01 | Mar 30, 2022 | DouPHP v1.6 Release 20220121 is affected by Cross Site Scripting (XSS) through /admin/login.php in the background, which will lead to JavaScript code execution. | ||
| CVE-2022-28202 | Med | 0.40 | 6.1 | 0.01 | Mar 30, 2022 | An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete. | ||
| CVE-2021-42970 | Med | 0.40 | 6.1 | 0.01 | Mar 29, 2022 | Cross Site Scripting (XSS) vulnerability exists in cxuucms v3 via the imgurl of /feedback/post/ content parameter. |
- risk 0.40cvss 6.1epss 0.02
There is a Cross-Site Scripting vulnerability in the JobSearch WP JobSearch WordPress plugin before 1.5.1.
- risk 0.40cvss 6.1epss 0.01
There are unauthenticated reflected Cross-Site Scripting (XSS) vulnerabilities in CareerUp Careerup WordPress theme before 2.3.1, via the filter parameters.
- risk 0.40cvss 6.1epss 0.01
The Wyzi Theme was affected by reflected XSS vulnerabilities in the business search feature
- risk 0.40cvss 6.1epss 0.04
The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters
- risk 0.40cvss 6.1epss 0.07
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.01
PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting (XSS) attacks via crafted HTTP headers.
- risk 0.40cvss 6.1epss 0.01
A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability exists in Maccms v10 via link_Name parameter.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.03
Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a remote attacker to inject an arbitrary script via a malicious URL.
- risk 0.40cvss 6.1epss 0.01
totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /home.asp.
- risk 0.40cvss 6.1epss 0.01
Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via parameters on user profile, system_info and accounts management.
- risk 0.40cvss 6.1epss 0.01
QingScan 1.3.0 is affected by Cross Site Scripting (XSS) vulnerability in all search functions.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in com_media.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using com_fields.
- risk 0.40cvss 6.1epss 0.01
DouPHP v1.6 Release 20220121 is affected by Cross Site Scripting (XSS) through /admin/login.php in the background, which will lead to JavaScript code execution.
- risk 0.40cvss 6.1epss 0.01
An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability exists in cxuucms v3 via the imgurl of /feedback/post/ content parameter.