CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 809 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-24984 | Med | 0.40 | 6.1 | 0.01 | Dec 27, 2021 | The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting | ||
| CVE-2021-24980 | Med | 0.40 | 6.1 | 0.01 | Dec 27, 2021 | The Gwolle Guestbook WordPress plugin before 4.2.0 does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in an admin page | ||
| CVE-2021-24979 | Med | 0.40 | 6.1 | 0.02 | Dec 27, 2021 | The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting | ||
| CVE-2021-24967 | Med | 0.40 | 6.1 | 0.01 | Dec 27, 2021 | The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads | ||
| CVE-2021-24797 | Med | 0.40 | 6.1 | 0.01 | Dec 27, 2021 | The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins. | ||
| CVE-2021-44598 | Med | 0.40 | 6.1 | 0.01 | Dec 26, 2021 | Attendance Management System 1.0 is affected by a Cross Site Scripting (XSS) vulnerability. The value of the FirstRecord request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The attacker can access the system, by… | ||
| CVE-2021-4169 | Med | 0.40 | 6.1 | 0.01 | Dec 26, 2021 | livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ||
| CVE-2021-45663 | Med | 0.40 | 6.1 | 0.01 | Dec 26, 2021 | NETGEAR R7000 devices before 1.0.11.126 are affected by stored XSS. | ||
| CVE-2021-45662 | Med | 0.40 | 6.1 | 0.01 | Dec 26, 2021 | NETGEAR R7000 devices before 1.0.9.88 are affected by stored XSS. | ||
| CVE-2021-45474 | Med | 0.40 | 6.1 | 0.01 | Dec 24, 2021 | In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl parameter. | ||
| CVE-2021-45473 | Med | 0.40 | 6.1 | 0.01 | Dec 24, 2021 | In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-information sidebar). | ||
| CVE-2021-45472 | Med | 0.40 | 6.1 | 0.01 | Dec 24, 2021 | In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used. | ||
| CVE-2021-44543 | Med | 0.40 | 6.1 | 0.01 | Dec 23, 2021 | An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the template name when Privoxy is configured to servce the user-manual itself. | ||
| CVE-2020-20605 | Med | 0.40 | 6.1 | 0.01 | Dec 22, 2021 | Blog CMS v1.0 contains a cross-site scripting (XSS) vulnerability in the /controller/CommentAdminController.java component. | ||
| CVE-2020-20598 | Med | 0.40 | 6.1 | 0.01 | Dec 22, 2021 | A cross-site scripting (XSS) vulnerability in the Editing component of lemon V1.10.0 allows attackers to execute arbitrary web scripts or HTML. | ||
| CVE-2020-20597 | Med | 0.40 | 6.1 | 0.01 | Dec 22, 2021 | A cross-site scripting (XSS) vulnerability in the potrtalItemName parameter in \web\PortalController.java of lemon V1.10.0 allows attackers to execute arbitrary web scripts or HTML. | ||
| CVE-2020-20426 | Med | 0.40 | 6.1 | 0.01 | Dec 22, 2021 | S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in /function/booksave.php. | ||
| CVE-2020-20425 | Med | 0.40 | 6.1 | 0.01 | Dec 22, 2021 | S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in the search function. | ||
| CVE-2021-36885 | Med | 0.40 | 6.1 | 0.01 | Dec 22, 2021 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1). | ||
| CVE-2021-44030 | Med | 0.40 | 6.1 | 0.04 | Dec 22, 2021 | Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method of jQuery. |
- risk 0.40cvss 6.1epss 0.01
The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.01
The Gwolle Guestbook WordPress plugin before 4.2.0 does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in an admin page
- risk 0.40cvss 6.1epss 0.02
The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- risk 0.40cvss 6.1epss 0.01
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads
- risk 0.40cvss 6.1epss 0.01
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
- risk 0.40cvss 6.1epss 0.01
Attendance Management System 1.0 is affected by a Cross Site Scripting (XSS) vulnerability. The value of the FirstRecord request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The attacker can access the system, by…
- risk 0.40cvss 6.1epss 0.01
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- risk 0.40cvss 6.1epss 0.01
NETGEAR R7000 devices before 1.0.11.126 are affected by stored XSS.
- risk 0.40cvss 6.1epss 0.01
NETGEAR R7000 devices before 1.0.9.88 are affected by stored XSS.
- risk 0.40cvss 6.1epss 0.01
In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl parameter.
- risk 0.40cvss 6.1epss 0.01
In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-information sidebar).
- risk 0.40cvss 6.1epss 0.01
In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used.
- risk 0.40cvss 6.1epss 0.01
An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the template name when Privoxy is configured to servce the user-manual itself.
- risk 0.40cvss 6.1epss 0.01
Blog CMS v1.0 contains a cross-site scripting (XSS) vulnerability in the /controller/CommentAdminController.java component.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in the Editing component of lemon V1.10.0 allows attackers to execute arbitrary web scripts or HTML.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in the potrtalItemName parameter in \web\PortalController.java of lemon V1.10.0 allows attackers to execute arbitrary web scripts or HTML.
- risk 0.40cvss 6.1epss 0.01
S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in /function/booksave.php.
- risk 0.40cvss 6.1epss 0.01
S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in the search function.
- risk 0.40cvss 6.1epss 0.01
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).
- risk 0.40cvss 6.1epss 0.04
Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method of jQuery.