CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (23,319)
page 815 of 1,166| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-39125 | 0.00 | — | 0.00 | Jul 17, 2024 | Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header. | |||
| CVE-2024-39124 | 0.00 | — | 0.00 | Jul 17, 2024 | In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS. | |||
| CVE-2024-39126 | 0.00 | — | 0.00 | Jul 17, 2024 | Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents. | |||
| CVE-2024-27095 | 0.00 | — | 0.00 | Jul 10, 2024 | Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1. | |||
| CVE-2024-39031 | 0.00 | — | 0.01 | Jul 9, 2024 | In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and… | |||
| CVE-2024-39308 | — | 0.00 | — | 0.01 | Jul 8, 2024 | RailsAdmin is a Rails engine that provides an interface for managing data. RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute. Upgrade to 3.1.3 or 2.2.2 (to be released). | ||
| CVE-2024-37389 | 0.00 | — | 0.24 | Jul 8, 2024 | Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code,… | |||
| CVE-2024-37146 | 0.00 | — | 0.00 | Jul 1, 2024 | Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `/api/v1/credentials/id` endpoint. If the default configuration is used (unauthenticated), an… | |||
| CVE-2024-37145 | 0.00 | — | 0.00 | Jul 1, 2024 | Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `/api/v1/chatflows-streaming/id` endpoint. If the default configuration is used (unauthenticated),… | |||
| CVE-2024-36423 | 0.00 | — | 0.00 | Jul 1, 2024 | Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `/api/v1/public-chatflows/id` endpoint. If the default configuration is used (unauthenticated), an… | |||
| CVE-2024-36422 | 0.00 | — | 0.00 | Jul 1, 2024 | Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `api/v1/chatflows/id` endpoint. If the default configuration is used (unauthenticated), an attacker… | |||
| CVE-2024-5062 | 0.00 | — | 0.00 | Jun 30, 2024 | A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to… | |||
| CVE-2024-25637 | 0.00 | — | 0.00 | Jun 26, 2024 | October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX handler name and allows unescaped HTML to be reflected back. There is no impact since this vulnerability cannot be exploited through normal… | |||
| CVE-2024-38274 | 0.00 | — | 0.00 | Jun 18, 2024 | Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt. | |||
| CVE-2024-34105 | 0.00 | — | 0.01 | Jun 13, 2024 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a… | |||
| CVE-2024-37297 | 0.00 | — | 0.00 | Jun 12, 2024 | WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad actor can manipulate a link to include malicious HTML & JavaScript content. While the content is not saved to the database,… | |||
| CVE-2024-37629 | — | 0.00 | — | 0.00 | Jun 12, 2024 | SummerNote v0.9.1 is vulnerable to Cross Site Scripting (XSS) via the Code View Function. | ||
| CVE-2024-35225 | 0.00 | — | 0.00 | Jun 11, 2024 | Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4.2.0 have a reflected cross-site scripting (XSS) issue. The `/proxy` endpoint… | |||
| CVE-2024-37160 | 0.00 | — | 0.00 | Jun 7, 2024 | Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scripts by modifying site options via /panel/options/site. This type of attack is suitable for persistence, affecting visitors across all pages… | |||
| CVE-2024-2171 | 0.00 | — | 0.00 | Jun 6, 2024 | A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their… |
- CVE-2024-39125Jul 17, 2024risk 0.00cvss —epss 0.00
Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.
- CVE-2024-39124Jul 17, 2024risk 0.00cvss —epss 0.00
In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.
- CVE-2024-39126Jul 17, 2024risk 0.00cvss —epss 0.00
Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.
- CVE-2024-27095Jul 10, 2024risk 0.00cvss —epss 0.00
Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1.
- CVE-2024-39031Jul 9, 2024risk 0.00cvss —epss 0.01
In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and…
- CVE-2024-39308Jul 8, 2024risk 0.00cvss —epss 0.01
RailsAdmin is a Rails engine that provides an interface for managing data. RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute. Upgrade to 3.1.3 or 2.2.2 (to be released).
- CVE-2024-37389Jul 8, 2024risk 0.00cvss —epss 0.24
Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code,…
- CVE-2024-37146Jul 1, 2024risk 0.00cvss —epss 0.00
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `/api/v1/credentials/id` endpoint. If the default configuration is used (unauthenticated), an…
- CVE-2024-37145Jul 1, 2024risk 0.00cvss —epss 0.00
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `/api/v1/chatflows-streaming/id` endpoint. If the default configuration is used (unauthenticated),…
- CVE-2024-36423Jul 1, 2024risk 0.00cvss —epss 0.00
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `/api/v1/public-chatflows/id` endpoint. If the default configuration is used (unauthenticated), an…
- CVE-2024-36422Jul 1, 2024risk 0.00cvss —epss 0.00
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `api/v1/chatflows/id` endpoint. If the default configuration is used (unauthenticated), an attacker…
- CVE-2024-5062Jun 30, 2024risk 0.00cvss —epss 0.00
A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to…
- CVE-2024-25637Jun 26, 2024risk 0.00cvss —epss 0.00
October is a self-hosted CMS platform based on the Laravel PHP Framework. The X-October-Request-Handler Header does not sanitize the AJAX handler name and allows unescaped HTML to be reflected back. There is no impact since this vulnerability cannot be exploited through normal…
- CVE-2024-38274Jun 18, 2024risk 0.00cvss —epss 0.00
Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.
- CVE-2024-34105Jun 13, 2024risk 0.00cvss —epss 0.01
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a…
- CVE-2024-37297Jun 12, 2024risk 0.00cvss —epss 0.00
WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad actor can manipulate a link to include malicious HTML & JavaScript content. While the content is not saved to the database,…
- CVE-2024-37629Jun 12, 2024risk 0.00cvss —epss 0.00
SummerNote v0.9.1 is vulnerable to Cross Site Scripting (XSS) via the Code View Function.
- CVE-2024-35225Jun 11, 2024risk 0.00cvss —epss 0.00
Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4.2.0 have a reflected cross-site scripting (XSS) issue. The `/proxy` endpoint…
- CVE-2024-37160Jun 7, 2024risk 0.00cvss —epss 0.00
Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scripts by modifying site options via /panel/options/site. This type of attack is suitable for persistence, affecting visitors across all pages…
- CVE-2024-2171Jun 6, 2024risk 0.00cvss —epss 0.00
A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their…