CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 796 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-26980 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO. | ||
| CVE-2022-0818 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, as well as does not sanitize its settings, which enables an unauthenticated attacker to inject malicious XSS payloads into the settings… | ||
| CVE-2022-0680 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable option, which is then displayed in the admin panel without sanitisation and escaping, leading to a Stored Cross-Site Scripting issue | ||
| CVE-2022-0647 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | The Bulk Creator WordPress plugin through 1.0.1 does not sanitize and escape the post_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. | ||
| CVE-2022-0643 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | The Bank Mellat WordPress plugin through 1.3.7 does not sanitize and escape the orderId parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. | ||
| CVE-2022-0641 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. | ||
| CVE-2022-0621 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | The dTabs WordPress plugin through 1.4 does not sanitize and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. | ||
| CVE-2022-0620 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | The Delete Old Orders WordPress plugin through 0.2 does not sanitize and escape the date parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. | ||
| CVE-2022-0619 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | The Database Peek WordPress plugin through 1.2 does not sanitize and escape the match parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. | ||
| CVE-2022-0600 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | The Conference Scheduler WordPress plugin before 2.4.3 does not sanitize and escape the tab parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting. | ||
| CVE-2022-0599 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. | ||
| CVE-2021-25071 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting | ||
| CVE-2021-25012 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues | ||
| CVE-2021-24746 | Med | 0.40 | 6.1 | 0.02 | Mar 28, 2022 | The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled (which is the default setting), leading to a Reflected Cross-Site Scripting issue. | ||
| CVE-2021-43721 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note. This leads to remote code execution with payload : | ||
| CVE-2021-43725 | Med | 0.40 | 6.1 | 0.03 | Mar 28, 2022 | There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the data[performredirect] parameter. | ||
| CVE-2021-44213 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message. | ||
| CVE-2021-44212 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring. | ||
| CVE-2021-44210 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data. | ||
| CVE-2021-44209 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2022 | OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO. |
- risk 0.40cvss 6.1epss 0.01
Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO.
- risk 0.40cvss 6.1epss 0.01
The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, as well as does not sanitize its settings, which enables an unauthenticated attacker to inject malicious XSS payloads into the settings…
- risk 0.40cvss 6.1epss 0.01
The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable option, which is then displayed in the admin panel without sanitisation and escaping, leading to a Stored Cross-Site Scripting issue
- risk 0.40cvss 6.1epss 0.01
The Bulk Creator WordPress plugin through 1.0.1 does not sanitize and escape the post_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- risk 0.40cvss 6.1epss 0.01
The Bank Mellat WordPress plugin through 1.3.7 does not sanitize and escape the orderId parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- risk 0.40cvss 6.1epss 0.01
The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- risk 0.40cvss 6.1epss 0.01
The dTabs WordPress plugin through 1.4 does not sanitize and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- risk 0.40cvss 6.1epss 0.01
The Delete Old Orders WordPress plugin through 0.2 does not sanitize and escape the date parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- risk 0.40cvss 6.1epss 0.01
The Database Peek WordPress plugin through 1.2 does not sanitize and escape the match parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- risk 0.40cvss 6.1epss 0.01
The Conference Scheduler WordPress plugin before 2.4.3 does not sanitize and escape the tab parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting.
- risk 0.40cvss 6.1epss 0.01
The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- risk 0.40cvss 6.1epss 0.01
The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.01
The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues
- risk 0.40cvss 6.1epss 0.02
The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled (which is the default setting), leading to a Reflected Cross-Site Scripting issue.
- risk 0.40cvss 6.1epss 0.01
Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note. This leads to remote code execution with payload :
- risk 0.40cvss 6.1epss 0.03
There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the data[performredirect] parameter.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO.