CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 839 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-35373 | Med | 0.40 | 6.1 | 0.01 | Jun 17, 2021 | In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack. | ||
| CVE-2020-21316 | Med | 0.40 | 6.1 | 0.01 | Jun 15, 2021 | A Cross-site scripting (XSS) vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolen administrator cookies via the nickname parameter and gain access to the admin panel. | ||
| CVE-2021-24351 | Med | 0.40 | 6.1 | 0.02 | Jun 14, 2021 | The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users) | ||
| CVE-2021-24350 | Med | 0.40 | 6.1 | 0.01 | Jun 14, 2021 | The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The plugin would display the user's user agent string without validation or encoding within the WordPress admin panel. | ||
| CVE-2021-24349 | Med | 0.40 | 6.1 | 0.00 | Jun 14, 2021 | This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting… | ||
| CVE-2020-13688 | Med | 0.40 | 6.1 | 0.01 | Jun 11, 2021 | Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X… | ||
| CVE-2021-34540 | Med | 0.40 | 6.1 | 0.01 | Jun 11, 2021 | Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard. | ||
| CVE-2021-20293 | Med | 0.40 | 6.1 | 0.01 | Jun 10, 2021 | A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to launch a reflected… | ||
| CVE-2021-29049 | Med | 0.40 | 6.1 | 0.01 | Jun 9, 2021 | Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the… | ||
| CVE-2021-30133 | Med | 0.40 | 6.1 | 0.01 | Jun 9, 2021 | A cross-site scripting (XSS) vulnerability in CloverDX Server 5.9.0, CloverDX 5.8.1, CloverDX 5.7.0, and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionToken parameter of multiple methods in Simple HTTP API. This is resolved in 5.9.1 and… | ||
| CVE-2021-33666 | Med | 0.40 | 6.1 | 0.01 | Jun 9, 2021 | When SAP Commerce Cloud version 100, hosts a JavaScript storefront, it is vulnerable to MIME sniffing, which, in certain circumstances, could be used to facilitate an XSS attack or malware proliferation. | ||
| CVE-2021-21490 | Med | 0.40 | 6.1 | 0.01 | Jun 9, 2021 | SAP NetWeaver AS for ABAP (Web Survey), versions - 700, 702, 710, 711, 730, 731, 750, 750, 752, 75A, 75F, does not sufficiently encode input and output parameters which results in reflected cross site scripting vulnerability, through which a malicious user can access data… | ||
| CVE-2021-33829 | Med | 0.40 | 6.1 | 0.03 | Jun 9, 2021 | A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled. | ||
| CVE-2021-34364 | Med | 0.40 | 6.1 | 0.01 | Jun 9, 2021 | The Refined GitHub browser extension before 21.6.8 might allow XSS via a link in a document. NOTE: github.com sends Content-Security-Policy headers to, in general, address XSS and other concerns. | ||
| CVE-2021-22220 | Med | 0.40 | 6.1 | 0.01 | Jun 8, 2021 | An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XSS in blob viewer of notebooks. | ||
| CVE-2021-31738 | Med | 0.40 | 6.1 | 0.01 | Jun 8, 2021 | Adiscon LogAnalyzer 4.1.10 and 4.1.11 allow login.php XSS. | ||
| CVE-2021-26080 | Med | 0.40 | 6.1 | 0.01 | Jun 7, 2021 | EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability. | ||
| CVE-2021-26079 | Med | 0.40 | 6.1 | 0.01 | Jun 7, 2021 | The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… | ||
| CVE-2021-24342 | Med | 0.40 | 6.1 | 0.02 | Jun 7, 2021 | The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue. | ||
| CVE-2020-36384 | Med | 0.40 | 6.1 | 0.01 | Jun 7, 2021 | PageLayer before 1.3.5 allows reflected XSS via color settings. |
- risk 0.40cvss 6.1epss 0.01
In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack.
- risk 0.40cvss 6.1epss 0.01
A Cross-site scripting (XSS) vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolen administrator cookies via the nickname parameter and gain access to the admin panel.
- risk 0.40cvss 6.1epss 0.02
The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users)
- risk 0.40cvss 6.1epss 0.01
The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The plugin would display the user's user agent string without validation or encoding within the WordPress admin panel.
- risk 0.40cvss 6.1epss 0.00
This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X…
- risk 0.40cvss 6.1epss 0.01
Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard.
- risk 0.40cvss 6.1epss 0.01
A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to launch a reflected…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the…
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in CloverDX Server 5.9.0, CloverDX 5.8.1, CloverDX 5.7.0, and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionToken parameter of multiple methods in Simple HTTP API. This is resolved in 5.9.1 and…
- risk 0.40cvss 6.1epss 0.01
When SAP Commerce Cloud version 100, hosts a JavaScript storefront, it is vulnerable to MIME sniffing, which, in certain circumstances, could be used to facilitate an XSS attack or malware proliferation.
- risk 0.40cvss 6.1epss 0.01
SAP NetWeaver AS for ABAP (Web Survey), versions - 700, 702, 710, 711, 730, 731, 750, 750, 752, 75A, 75F, does not sufficiently encode input and output parameters which results in reflected cross site scripting vulnerability, through which a malicious user can access data…
- risk 0.40cvss 6.1epss 0.03
A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.
- risk 0.40cvss 6.1epss 0.01
The Refined GitHub browser extension before 21.6.8 might allow XSS via a link in a document. NOTE: github.com sends Content-Security-Policy headers to, in general, address XSS and other concerns.
- risk 0.40cvss 6.1epss 0.01
An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XSS in blob viewer of notebooks.
- risk 0.40cvss 6.1epss 0.01
Adiscon LogAnalyzer 4.1.10 and 4.1.11 allow login.php XSS.
- risk 0.40cvss 6.1epss 0.01
EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)…
- risk 0.40cvss 6.1epss 0.02
The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue.
- risk 0.40cvss 6.1epss 0.01
PageLayer before 1.3.5 allows reflected XSS via color settings.