CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (23,315)
page 843 of 1,166| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-29016 | 0.00 | — | 0.00 | Apr 6, 2023 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when using nicknames. An attacker could create a user account and enter… | |||
| CVE-2023-29015 | 0.00 | — | 0.00 | Apr 6, 2023 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted… | |||
| CVE-2023-29014 | 0.00 | — | 0.00 | Apr 6, 2023 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a… | |||
| CVE-2023-1879 | — | 0.00 | — | 0.00 | Apr 5, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||
| CVE-2023-1756 | — | 0.00 | — | 0.00 | Apr 5, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||
| CVE-2023-1757 | — | 0.00 | — | 0.01 | Apr 5, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||
| CVE-2023-1758 | — | 0.00 | — | 0.01 | Apr 5, 2023 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||
| CVE-2023-1892 | 0.00 | — | 0.03 | Apr 5, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository sidekiq/sidekiq prior to 7.0.8. | |||
| CVE-2023-1885 | — | 0.00 | — | 0.00 | Apr 5, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||
| CVE-2023-1884 | — | 0.00 | — | 0.00 | Apr 5, 2023 | Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||
| CVE-2023-1882 | — | 0.00 | — | 0.01 | Apr 5, 2023 | Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||
| CVE-2023-1881 | 0.00 | — | 0.00 | Apr 5, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3. | |||
| CVE-2023-1880 | — | 0.00 | — | 0.02 | Apr 5, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||
| CVE-2023-1878 | — | 0.00 | — | 0.01 | Apr 5, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12. | ||
| CVE-2020-19277 | — | 0.00 | — | 0.01 | Apr 4, 2023 | Cross Site Scripting vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via javascript code in the markdown editor. | ||
| CVE-2020-19697 | 0.00 | — | 0.01 | Apr 4, 2023 | Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script in the src parameter. | |||
| CVE-2020-19698 | 0.00 | — | 0.01 | Apr 4, 2023 | Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the editor parameter. | |||
| CVE-2023-0835 | — | 0.00 | — | 0.01 | Apr 4, 2023 | markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the Markdown content entered by the user. | ||
| CVE-2023-0325 | — | 0.00 | — | 0.01 | Apr 4, 2023 | Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the message sent by the clients in the ticket. | ||
| CVE-2023-28851 | — | 0.00 | — | 0.00 | Apr 3, 2023 | Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 and prior to versions 1.0.2, 1.1.0, 2.2.5, and 3.1.1, improper escaping when presenting stored form submissions allowed for an attacker to… |
- CVE-2023-29016Apr 6, 2023risk 0.00cvss —epss 0.00
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when using nicknames. An attacker could create a user account and enter…
- CVE-2023-29015Apr 6, 2023risk 0.00cvss —epss 0.00
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted…
- CVE-2023-29014Apr 6, 2023risk 0.00cvss —epss 0.00
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a…
- CVE-2023-1879Apr 5, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- CVE-2023-1756Apr 5, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- CVE-2023-1757Apr 5, 2023risk 0.00cvss —epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- CVE-2023-1758Apr 5, 2023risk 0.00cvss —epss 0.01
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- CVE-2023-1892Apr 5, 2023risk 0.00cvss —epss 0.03
Cross-site Scripting (XSS) - Reflected in GitHub repository sidekiq/sidekiq prior to 7.0.8.
- CVE-2023-1885Apr 5, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- CVE-2023-1884Apr 5, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- CVE-2023-1882Apr 5, 2023risk 0.00cvss —epss 0.01
Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- CVE-2023-1881Apr 5, 2023risk 0.00cvss —epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.
- CVE-2023-1880Apr 5, 2023risk 0.00cvss —epss 0.02
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- CVE-2023-1878Apr 5, 2023risk 0.00cvss —epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- CVE-2020-19277Apr 4, 2023risk 0.00cvss —epss 0.01
Cross Site Scripting vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via javascript code in the markdown editor.
- CVE-2020-19697Apr 4, 2023risk 0.00cvss —epss 0.01
Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script in the src parameter.
- CVE-2020-19698Apr 4, 2023risk 0.00cvss —epss 0.01
Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the editor parameter.
- CVE-2023-0835Apr 4, 2023risk 0.00cvss —epss 0.01
markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the Markdown content entered by the user.
- CVE-2023-0325Apr 4, 2023risk 0.00cvss —epss 0.01
Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the message sent by the clients in the ticket.
- CVE-2023-28851Apr 3, 2023risk 0.00cvss —epss 0.00
Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 and prior to versions 1.0.2, 1.1.0, 2.2.5, and 3.1.1, improper escaping when presenting stored form submissions allowed for an attacker to…