CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 843 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-31911 | Med | 0.40 | 6.1 | 0.01 | May 11, 2021 | In JetBrains TeamCity before 2020.2.3, reflected XSS was possible on several pages. | ||
| CVE-2020-35438 | Med | 0.40 | 6.1 | 0.01 | May 11, 2021 | Cross Site Scripting (XSS) vulnerability in the kk Star Ratings plugin before 4.1.5. | ||
| CVE-2021-31904 | Med | 0.40 | 6.1 | 0.01 | May 11, 2021 | In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page. | ||
| CVE-2021-31903 | Med | 0.40 | 6.1 | 0.01 | May 11, 2021 | In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS. | ||
| CVE-2020-23371 | Med | 0.40 | 6.1 | 0.01 | May 10, 2021 | Cross-site scripting (XSS) vulnerability in static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf in noneCms v1.3.0 allows remote attackers to inject arbitrary web script or HTML via the movieName parameter. | ||
| CVE-2020-23369 | Med | 0.40 | 6.1 | 0.01 | May 10, 2021 | In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3. | ||
| CVE-2020-18102 | Med | 0.40 | 6.1 | 0.01 | May 10, 2021 | Cross Site Scripting (XSS) in Hotels_Server v1.0 allows remote attackers to execute arbitrary code by injecting crafted commands the data fields in the component "/controller/publishHotel.php". | ||
| CVE-2021-20577 | Med | 0.40 | 6.1 | 0.01 | May 10, 2021 | IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted… | ||
| CVE-2021-20717 | Med | 0.40 | 6.1 | 0.02 | May 10, 2021 | Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the… | ||
| CVE-2021-26123 | Med | 0.40 | 6.1 | 0.01 | May 7, 2021 | LivingLogic XIST4C before 0.107.8 allows XSS via login.htm, login.wihtm, or login-form.htm. | ||
| CVE-2021-26122 | Med | 0.40 | 6.1 | 0.01 | May 7, 2021 | LivingLogic XIST4C before 0.107.8 allows XSS via feedback.htm or feedback.wihtm. | ||
| CVE-2021-32092 | Med | 0.40 | 6.1 | 0.01 | May 7, 2021 | A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the uuid parameter. | ||
| CVE-2021-32091 | Med | 0.40 | 6.1 | 0.01 | May 7, 2021 | A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6. | ||
| CVE-2020-23263 | Med | 0.40 | 6.1 | 0.01 | May 6, 2021 | Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the "navigation_title" parameter and the "title" parameter in /private/en/pages/add. | ||
| CVE-2021-24214 | Med | 0.40 | 6.1 | 0.02 | May 6, 2021 | The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default… | ||
| CVE-2021-24293 | Med | 0.40 | 6.1 | 0.01 | May 5, 2021 | In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ajax , after that the settings[shipping_address][name] is able to inject malicious javascript. | ||
| CVE-2021-20397 | Med | 0.40 | 6.1 | 0.01 | May 5, 2021 | IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:… | ||
| CVE-2020-13666 | Med | 0.40 | 6.1 | 0.03 | May 5, 2021 | Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions… | ||
| CVE-2021-25179 | Med | 0.40 | 6.1 | 0.01 | May 5, 2021 | SolarWinds Serv-U before 15.2 is affected by Cross Site Scripting (XSS) via the HTTP Host header. | ||
| CVE-2020-28945 | Med | 0.40 | 6.1 | 0.01 | May 3, 2021 | OX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature, such as  vulnerability in the kk Star Ratings plugin before 4.1.5.
- risk 0.40cvss 6.1epss 0.01
In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page.
- risk 0.40cvss 6.1epss 0.01
In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf in noneCms v1.3.0 allows remote attackers to inject arbitrary web script or HTML via the movieName parameter.
- risk 0.40cvss 6.1epss 0.01
In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) in Hotels_Server v1.0 allows remote attackers to execute arbitrary code by injecting crafted commands the data fields in the component "/controller/publishHotel.php".
- risk 0.40cvss 6.1epss 0.01
IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
- risk 0.40cvss 6.1epss 0.02
Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the…
- risk 0.40cvss 6.1epss 0.01
LivingLogic XIST4C before 0.107.8 allows XSS via login.htm, login.wihtm, or login-form.htm.
- risk 0.40cvss 6.1epss 0.01
LivingLogic XIST4C before 0.107.8 allows XSS via feedback.htm or feedback.wihtm.
- risk 0.40cvss 6.1epss 0.01
A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the uuid parameter.
- risk 0.40cvss 6.1epss 0.01
A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6.
- risk 0.40cvss 6.1epss 0.01
Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the "navigation_title" parameter and the "title" parameter in /private/en/pages/add.
- risk 0.40cvss 6.1epss 0.02
The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default…
- risk 0.40cvss 6.1epss 0.01
In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ajax , after that the settings[shipping_address][name] is able to inject malicious javascript.
- risk 0.40cvss 6.1epss 0.01
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
- risk 0.40cvss 6.1epss 0.03
Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions…
- risk 0.40cvss 6.1epss 0.01
SolarWinds Serv-U before 15.2 is affected by Cross Site Scripting (XSS) via the HTTP Host header.
- risk 0.40cvss 6.1epss 0.01
OX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature, such as ![](http://onerror=Function.constructor, in a Notes item.