CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (23,317)
page 828 of 1,166| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-48088 | — | 0.00 | — | 0.00 | Nov 15, 2023 | xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage. | ||
| CVE-2023-47125 | — | 0.00 | — | 0.01 | Nov 14, 2023 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been… | ||
| CVE-2023-48094 | — | 0.00 | — | 0.00 | Nov 14, 2023 | A cross-site scripting (XSS) vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim's browser via sending a crafted payload to /container_files/public_html/doc/index.html. NOTE: the vendor’s position is that… | ||
| CVE-2023-46735 | 0.00 | — | 0.01 | Nov 10, 2023 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in version 6.0.0 and prior to version 6.3.8, the error message in `WebhookController` returns unescaped user-submitted input. As of version 6.3.8, `WebhookController` now… | |||
| CVE-2023-46734 | 0.00 | — | 0.01 | Nov 10, 2023 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their… | |||
| CVE-2023-5547 | 0.00 | — | 0.01 | Nov 9, 2023 | The course upload preview contained an XSS risk for users uploading unsafe data. | |||
| CVE-2023-5546 | 0.00 | — | 0.01 | Nov 9, 2023 | ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. | |||
| CVE-2023-5544 | 0.00 | — | 0.01 | Nov 9, 2023 | Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk. | |||
| CVE-2023-5541 | 0.00 | — | 0.01 | Nov 9, 2023 | The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content. | |||
| CVE-2023-45885 | — | 0.00 | — | 0.00 | Nov 9, 2023 | Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new component feature in the flexibleLayout plugin. | ||
| CVE-2023-47114 | 0.00 | — | 0.01 | Nov 8, 2023 | Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of privacy regulations in your code. The Fides web application allows data subject users to request access to their… | |||
| CVE-2023-47379 | — | 0.00 | — | 0.01 | Nov 8, 2023 | Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality. | ||
| CVE-2023-46732 | 0.00 | — | 0.02 | Nov 6, 2023 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to reflected cross-site scripting (RXSS) via the `rev` parameter that is used in the content of the content menu without escaping. If an attacker can… | |||
| CVE-2023-5917 | 0.00 | — | 0.01 | Nov 2, 2023 | A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross site scripting.… | |||
| CVE-2023-46925 | 0.00 | — | 0.00 | Nov 2, 2023 | Reportico 7.1.21 is vulnerable to Cross Site Scripting (XSS). | |||
| CVE-2023-46722 | 0.00 | — | 0.01 | Oct 31, 2023 | The Pimcore Admin Classic Bundle provides a backend UI for Pimcore. Prior to version 1.2.0, a cross-site scripting vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other… | |||
| CVE-2023-5873 | 0.00 | — | 0.00 | Oct 31, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 11.1.0. | |||
| CVE-2023-5867 | — | 0.00 | — | 0.00 | Oct 31, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.2. | ||
| CVE-2023-5864 | — | 0.00 | — | 0.01 | Oct 31, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1. | ||
| CVE-2023-5863 | — | 0.00 | — | 0.01 | Oct 31, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
- CVE-2023-48088Nov 15, 2023risk 0.00cvss —epss 0.00
xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage.
- CVE-2023-47125Nov 14, 2023risk 0.00cvss —epss 0.01
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been…
- CVE-2023-48094Nov 14, 2023risk 0.00cvss —epss 0.00
A cross-site scripting (XSS) vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim's browser via sending a crafted payload to /container_files/public_html/doc/index.html. NOTE: the vendor’s position is that…
- CVE-2023-46735Nov 10, 2023risk 0.00cvss —epss 0.01
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in version 6.0.0 and prior to version 6.3.8, the error message in `WebhookController` returns unescaped user-submitted input. As of version 6.3.8, `WebhookController` now…
- CVE-2023-46734Nov 10, 2023risk 0.00cvss —epss 0.01
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their…
- CVE-2023-5547Nov 9, 2023risk 0.00cvss —epss 0.01
The course upload preview contained an XSS risk for users uploading unsafe data.
- CVE-2023-5546Nov 9, 2023risk 0.00cvss —epss 0.01
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.
- CVE-2023-5544Nov 9, 2023risk 0.00cvss —epss 0.01
Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.
- CVE-2023-5541Nov 9, 2023risk 0.00cvss —epss 0.01
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
- CVE-2023-45885Nov 9, 2023risk 0.00cvss —epss 0.00
Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new component feature in the flexibleLayout plugin.
- CVE-2023-47114Nov 8, 2023risk 0.00cvss —epss 0.01
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of privacy regulations in your code. The Fides web application allows data subject users to request access to their…
- CVE-2023-47379Nov 8, 2023risk 0.00cvss —epss 0.01
Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality.
- CVE-2023-46732Nov 6, 2023risk 0.00cvss —epss 0.02
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to reflected cross-site scripting (RXSS) via the `rev` parameter that is used in the content of the content menu without escaping. If an attacker can…
- CVE-2023-5917Nov 2, 2023risk 0.00cvss —epss 0.01
A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross site scripting.…
- CVE-2023-46925Nov 2, 2023risk 0.00cvss —epss 0.00
Reportico 7.1.21 is vulnerable to Cross Site Scripting (XSS).
- CVE-2023-46722Oct 31, 2023risk 0.00cvss —epss 0.01
The Pimcore Admin Classic Bundle provides a backend UI for Pimcore. Prior to version 1.2.0, a cross-site scripting vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other…
- CVE-2023-5873Oct 31, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 11.1.0.
- CVE-2023-5867Oct 31, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
- CVE-2023-5864Oct 31, 2023risk 0.00cvss —epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1.
- CVE-2023-5863Oct 31, 2023risk 0.00cvss —epss 0.01
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2.