CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 836 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-26039 | Med | 0.40 | 6.1 | 0.01 | Jul 7, 2021 | An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the imagelist view of com_media leads to a XSS vulnerability. | ||
| CVE-2021-26035 | Med | 0.40 | 6.1 | 0.01 | Jul 7, 2021 | An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the rules field of the JForm API leads to a XSS vulnerability. | ||
| CVE-2021-22227 | Med | 0.40 | 6.1 | 0.01 | Jul 7, 2021 | A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker to send a malicious link to a victim and trigger actions on their behalf if they clicked it | ||
| CVE-2021-22223 | Med | 0.40 | 6.1 | 0.01 | Jul 6, 2021 | Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link | ||
| CVE-2021-35440 | Med | 0.40 | 6.1 | 0.01 | Jul 6, 2021 | Smashing 1.3.4 is vulnerable to Cross Site Scripting (XSS). A URL for a widget can be crafted and used to execute JavaScript on the victim's computer. The JavaScript code can then steal data available in the session/cookies depending on the user environment (e.g. if re-using… | ||
| CVE-2021-24407 | Med | 0.40 | 6.1 | 0.03 | Jul 6, 2021 | The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX action, leading to a Reflected Cross-site Scripting (XSS) vulnerability. | ||
| CVE-2021-24389 | Med | 0.40 | 6.1 | 0.04 | Jul 6, 2021 | The WP Foodbakery WordPress plugin before 2.2, used in the FoodBakery WordPress theme before 2.2 did not properly sanitize the foodbakery_radius parameter before outputting it back in the response, leading to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2021-24387 | Med | 0.40 | 6.1 | 0.04 | Jul 6, 2021 | The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user… | ||
| CVE-2021-32233 | Med | 0.40 | 6.1 | 0.01 | Jul 6, 2021 | SmarterTools SmarterMail before Build 7776 allows XSS. | ||
| CVE-2021-33192 | Med | 0.40 | 6.1 | 0.03 | Jul 5, 2021 | A vulnerability in the HTML pages of Apache Jena Fuseki allows an attacker to execute arbitrary javascript on certain page views. This issue affects Apache Jena Fuseki from version 2.0.0 to version 4.0.0 (inclusive). | ||
| CVE-2021-35207 | Med | 0.40 | 6.1 | 0.03 | Jul 2, 2021 | An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the… | ||
| CVE-2021-20752 | Med | 0.40 | 6.1 | 0.01 | Jul 1, 2021 | Cross-site scripting vulnerability in IkaIka RSS Reader all versions allows a remote attacker to inject an arbitrary script via unspecified vectors. | ||
| CVE-2020-36196 | Med | 0.40 | 6.1 | 0.01 | Jul 1, 2021 | A stored XSS vulnerability has been reported to affect QNAP NAS running QuLog Center. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QuLog Center versions prior to 1.2.0. | ||
| CVE-2020-36194 | Med | 0.40 | 6.1 | 0.01 | Jul 1, 2021 | An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.2.1566 Build 20210202. QNAP Systems Inc. QuTS hero… | ||
| CVE-2021-31721 | Med | 0.40 | 6.1 | 0.01 | Jun 30, 2021 | Chevereto before 3.17.1 allows Cross Site Scripting (XSS) via an image title at the image upload stage. | ||
| CVE-2020-18066 | Med | 0.40 | 6.1 | 0.01 | Jun 29, 2021 | Cross Site Scripting vulnerability in ZrLog 2.1.0 via the (1) userName and (2) email parameters in post/addComment. | ||
| CVE-2021-20103 | Med | 0.40 | 6.1 | 0.01 | Jun 29, 2021 | Machform prior to version 16 is vulnerable to stored cross-site scripting due to insufficient sanitization of file attachments uploaded with forms through upload.php. | ||
| CVE-2021-35303 | Med | 0.40 | 6.1 | 0.01 | Jun 28, 2021 | Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute. | ||
| CVE-2021-35298 | Med | 0.40 | 6.1 | 0.01 | Jun 28, 2021 | Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store additional information. | ||
| CVE-2020-21142 | Med | 0.40 | 6.1 | 0.01 | Jun 28, 2021 | Cross Site Scripting (XSS) vulnerabilty in IPFire 2.23 via the IPfire web UI in the mail.cgi. |
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the imagelist view of com_media leads to a XSS vulnerability.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the rules field of the JForm API leads to a XSS vulnerability.
- risk 0.40cvss 6.1epss 0.01
A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker to send a malicious link to a victim and trigger actions on their behalf if they clicked it
- risk 0.40cvss 6.1epss 0.01
Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link
- risk 0.40cvss 6.1epss 0.01
Smashing 1.3.4 is vulnerable to Cross Site Scripting (XSS). A URL for a widget can be crafted and used to execute JavaScript on the victim's computer. The JavaScript code can then steal data available in the session/cookies depending on the user environment (e.g. if re-using…
- risk 0.40cvss 6.1epss 0.03
The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX action, leading to a Reflected Cross-site Scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.04
The WP Foodbakery WordPress plugin before 2.2, used in the FoodBakery WordPress theme before 2.2 did not properly sanitize the foodbakery_radius parameter before outputting it back in the response, leading to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.04
The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user…
- risk 0.40cvss 6.1epss 0.01
SmarterTools SmarterMail before Build 7776 allows XSS.
- risk 0.40cvss 6.1epss 0.03
A vulnerability in the HTML pages of Apache Jena Fuseki allows an attacker to execute arbitrary javascript on certain page views. This issue affects Apache Jena Fuseki from version 2.0.0 to version 4.0.0 (inclusive).
- risk 0.40cvss 6.1epss 0.03
An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in IkaIka RSS Reader all versions allows a remote attacker to inject an arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
A stored XSS vulnerability has been reported to affect QNAP NAS running QuLog Center. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QuLog Center versions prior to 1.2.0.
- risk 0.40cvss 6.1epss 0.01
An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.2.1566 Build 20210202. QNAP Systems Inc. QuTS hero…
- risk 0.40cvss 6.1epss 0.01
Chevereto before 3.17.1 allows Cross Site Scripting (XSS) via an image title at the image upload stage.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting vulnerability in ZrLog 2.1.0 via the (1) userName and (2) email parameters in post/addComment.
- risk 0.40cvss 6.1epss 0.01
Machform prior to version 16 is vulnerable to stored cross-site scripting due to insufficient sanitization of file attachments uploaded with forms through upload.php.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store additional information.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerabilty in IPFire 2.23 via the IPfire web UI in the mail.cgi.