CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 844 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-31935 | Med | 0.40 | 6.1 | 0.01 | Apr 30, 2021 | OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list (payload in the common name) that is mishandled in the scheduling view. | ||
| CVE-2021-31934 | Med | 0.40 | 6.1 | 0.01 | Apr 30, 2021 | OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the App Suite UI on a smartphone. | ||
| CVE-2021-21541 | Med | 0.40 | 6.1 | 0.01 | Apr 30, 2021 | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM… | ||
| CVE-2020-18084 | Med | 0.40 | 6.1 | 0.01 | Apr 30, 2021 | Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to the component "/member/index/login.html" when logging in. | ||
| CVE-2020-1721 | Med | 0.40 | 6.1 | 0.01 | Apr 30, 2021 | A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting (XSS) vulnerability. An attacker could trick an authenticated victim… | ||
| CVE-2020-18035 | Med | 0.40 | 6.1 | 0.01 | Apr 29, 2021 | Cross Site Scripting (XSS) in Jeesns v1.4.2 allows remote attackers to execute arbitrary code by injecting commands into the "CKEditorFuncNum" parameter in the component "CkeditorUploadController.java". | ||
| CVE-2020-22808 | Med | 0.40 | 6.1 | 0.01 | Apr 29, 2021 | An issue was found in yii2_fecshop 2.x. There is a reflected XSS vulnerability in the check cart page. | ||
| CVE-2021-30227 | Med | 0.40 | 6.1 | 0.01 | Apr 29, 2021 | Cross Site Scripting (XSS) vulnerability in the article comments feature in emlog 6.0. | ||
| CVE-2021-25810 | Med | 0.40 | 6.1 | 0.01 | Apr 29, 2021 | Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury X18G 1.0.5 devices, via crafted values to the 'src_dport_start', 'src_dport_end', and 'dest_port' parameters. | ||
| CVE-2021-28280 | Med | 0.40 | 6.1 | 0.01 | Apr 29, 2021 | CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML | ||
| CVE-2020-22789 | Med | 0.40 | 6.1 | 0.01 | Apr 28, 2021 | Unauthenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via the login page. The XSS is executed when an administrator accesses the logs. | ||
| CVE-2020-18022 | Med | 0.40 | 6.1 | 0.01 | Apr 28, 2021 | Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtain sensitive information by injecting arbitrary commands in a HTTP request to the "ewebeditor\3.1.1\kindeditor.js" component. | ||
| CVE-2020-17999 | Med | 0.40 | 6.1 | 0.02 | Apr 28, 2021 | Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via a crafted HTTP request to the component "/mc-admin/post-edit.php". | ||
| CVE-2020-21993 | Med | 0.40 | 6.1 | 0.01 | Apr 28, 2021 | In WEMS Limited Enterprise Manager 2.58, input passed to the GET parameter 'email' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site. | ||
| CVE-2021-29159 | Med | 0.40 | 6.1 | 0.01 | Apr 28, 2021 | A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. An attacker with a local account can create entities with crafted properties that, when viewed by an administrator, can execute arbitrary JavaScript in the context of… | ||
| CVE-2020-21987 | Med | 0.40 | 6.1 | 0.01 | Apr 27, 2021 | HomeAutomation 3.3.2 is affected by persistent Cross Site Scripting (XSS). XSS vulnerabilities occur when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and… | ||
| CVE-2021-25838 | Med | 0.40 | 6.1 | 0.01 | Apr 26, 2021 | The Import function in MintHCM RELEASE 3.0.8 allows an attacker to execute a cross-site scripting (XSS) payload in file-upload. | ||
| CVE-2021-28079 | Med | 0.40 | 6.1 | 0.01 | Apr 26, 2021 | Jamovi <=1.6.18 is affected by a cross-site scripting (XSS) vulnerability. The column-name is vulnerable to XSS in the ElectronJS Framework. An attacker can make a .omv (Jamovi) document containing a payload. When opened by victim, the payload is triggered. | ||
| CVE-2021-31803 | Med | 0.40 | 6.1 | 0.01 | Apr 26, 2021 | cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581). | ||
| CVE-2021-20710 | Med | 0.40 | 6.1 | 0.01 | Apr 26, 2021 | Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.5.1 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors. |
- risk 0.40cvss 6.1epss 0.01
OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list (payload in the common name) that is mishandled in the scheduling view.
- risk 0.40cvss 6.1epss 0.01
OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the App Suite UI on a smartphone.
- risk 0.40cvss 6.1epss 0.01
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM…
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to the component "/member/index/login.html" when logging in.
- risk 0.40cvss 6.1epss 0.01
A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting (XSS) vulnerability. An attacker could trick an authenticated victim…
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) in Jeesns v1.4.2 allows remote attackers to execute arbitrary code by injecting commands into the "CKEditorFuncNum" parameter in the component "CkeditorUploadController.java".
- risk 0.40cvss 6.1epss 0.01
An issue was found in yii2_fecshop 2.x. There is a reflected XSS vulnerability in the check cart page.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability in the article comments feature in emlog 6.0.
- risk 0.40cvss 6.1epss 0.01
Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury X18G 1.0.5 devices, via crafted values to the 'src_dport_start', 'src_dport_end', and 'dest_port' parameters.
- risk 0.40cvss 6.1epss 0.01
CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML
- risk 0.40cvss 6.1epss 0.01
Unauthenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via the login page. The XSS is executed when an administrator accesses the logs.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtain sensitive information by injecting arbitrary commands in a HTTP request to the "ewebeditor\3.1.1\kindeditor.js" component.
- risk 0.40cvss 6.1epss 0.02
Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via a crafted HTTP request to the component "/mc-admin/post-edit.php".
- risk 0.40cvss 6.1epss 0.01
In WEMS Limited Enterprise Manager 2.58, input passed to the GET parameter 'email' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. An attacker with a local account can create entities with crafted properties that, when viewed by an administrator, can execute arbitrary JavaScript in the context of…
- risk 0.40cvss 6.1epss 0.01
HomeAutomation 3.3.2 is affected by persistent Cross Site Scripting (XSS). XSS vulnerabilities occur when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and…
- risk 0.40cvss 6.1epss 0.01
The Import function in MintHCM RELEASE 3.0.8 allows an attacker to execute a cross-site scripting (XSS) payload in file-upload.
- risk 0.40cvss 6.1epss 0.01
Jamovi <=1.6.18 is affected by a cross-site scripting (XSS) vulnerability. The column-name is vulnerable to XSS in the ElectronJS Framework. An attacker can make a .omv (Jamovi) document containing a payload. When opened by victim, the payload is triggered.
- risk 0.40cvss 6.1epss 0.01
cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.5.1 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.