CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 847 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-20690 | Med | 0.40 | 6.1 | 0.01 | Apr 7, 2021 | Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors. | ||
| CVE-2021-20689 | Med | 0.40 | 6.1 | 0.01 | Apr 7, 2021 | Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors. | ||
| CVE-2021-20688 | Med | 0.40 | 6.1 | 0.01 | Apr 7, 2021 | Cross-site scripting vulnerability in Click Ranker Ver.3.5 allows remote attackers to inject an arbitrary script via unspecified vectors. | ||
| CVE-2021-20686 | Med | 0.40 | 6.1 | 0.01 | Apr 7, 2021 | Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors. | ||
| CVE-2021-20685 | Med | 0.40 | 6.1 | 0.01 | Apr 7, 2021 | Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors. | ||
| CVE-2021-20684 | Med | 0.40 | 6.1 | 0.01 | Apr 7, 2021 | Cross-site scripting vulnerability in MagazinegerZ v.1.01 allows remote attackers to inject an arbitrary script via unspecified vectors. | ||
| CVE-2021-22157 | Med | 0.40 | 6.1 | 0.02 | Apr 6, 2021 | Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.11.1 allows stored XSS. | ||
| CVE-2020-13418 | Med | 0.40 | 6.1 | 0.01 | Apr 6, 2021 | OpenIAM before 4.2.0.3 allows XSS in the Add New User feature. | ||
| CVE-2021-30157 | Med | 0.40 | 6.1 | 0.01 | Apr 6, 2021 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist, some of the rcfilters-filter-* label messages are output in HTML unescaped, leading to XSS. | ||
| CVE-2021-30154 | Med | 0.40 | 6.1 | 0.01 | Apr 6, 2021 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS. | ||
| CVE-2021-24152 | Med | 0.40 | 6.1 | 0.01 | Apr 5, 2021 | The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting. | ||
| CVE-2021-30109 | Med | 0.40 | 6.1 | 0.01 | Apr 5, 2021 | Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS). Under certain conditions, a base64 crafted string leads to persistent Cross-site scripting (XSS) vulnerability within the hyperlink creation module. | ||
| CVE-2021-30058 | Med | 0.40 | 6.1 | 0.01 | Apr 5, 2021 | Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS). An attacker can inject arbitrary external script in '/knowagecockpitengine/api/1.0/pages/execute' via the 'SBI_HOST' parameter. | ||
| CVE-2021-30125 | Med | 0.40 | 6.1 | 0.01 | Apr 2, 2021 | Jamf Pro before 10.28.0 allows XSS related to inventory history, aka PI-009376. | ||
| CVE-2020-9995 | Med | 0.40 | 6.1 | 0.01 | Apr 2, 2021 | An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in macOS Server 5.11. Processing a maliciously crafted URL may lead to an open redirect or cross site scripting. | ||
| CVE-2021-29011 | Med | 0.40 | 6.1 | 0.01 | Apr 2, 2021 | DMA Softlab Radius Manager 4.4.0 is affected by Cross Site Scripting (XSS) via the description, name, or address field (under admin.php). | ||
| CVE-2021-25894 | Med | 0.40 | 6.1 | 0.01 | Apr 2, 2021 | Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the /magnoliaPublic/travel/members/login.html mgnlUserId parameter. | ||
| CVE-2021-23925 | Med | 0.40 | 6.1 | 0.01 | Apr 1, 2021 | An issue was discovered in Devolutions Server before 2020.3. There is a cross-site scripting (XSS) vulnerability in entries of type Document. | ||
| CVE-2021-26580 | Med | 0.40 | 6.1 | 0.01 | Apr 1, 2021 | A potential security vulnerability has been identified in HPE iLO Amplifier Pack. The vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS). HPE has provided the following software update to resolve the vulnerability in HPE iLO Amplifier Pack: HPE iLO… | ||
| CVE-2021-27349 | Med | 0.40 | 6.1 | 0.01 | Mar 31, 2021 | Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727. |
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Click Ranker Ver.3.5 allows remote attackers to inject an arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in MagazinegerZ v.1.01 allows remote attackers to inject an arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.02
Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.11.1 allows stored XSS.
- risk 0.40cvss 6.1epss 0.01
OpenIAM before 4.2.0.3 allows XSS in the Add New User feature.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist, some of the rcfilters-filter-* label messages are output in HTML unescaped, leading to XSS.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS.
- risk 0.40cvss 6.1epss 0.01
The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting.
- risk 0.40cvss 6.1epss 0.01
Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS). Under certain conditions, a base64 crafted string leads to persistent Cross-site scripting (XSS) vulnerability within the hyperlink creation module.
- risk 0.40cvss 6.1epss 0.01
Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS). An attacker can inject arbitrary external script in '/knowagecockpitengine/api/1.0/pages/execute' via the 'SBI_HOST' parameter.
- risk 0.40cvss 6.1epss 0.01
Jamf Pro before 10.28.0 allows XSS related to inventory history, aka PI-009376.
- risk 0.40cvss 6.1epss 0.01
An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in macOS Server 5.11. Processing a maliciously crafted URL may lead to an open redirect or cross site scripting.
- risk 0.40cvss 6.1epss 0.01
DMA Softlab Radius Manager 4.4.0 is affected by Cross Site Scripting (XSS) via the description, name, or address field (under admin.php).
- risk 0.40cvss 6.1epss 0.01
Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the /magnoliaPublic/travel/members/login.html mgnlUserId parameter.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Devolutions Server before 2020.3. There is a cross-site scripting (XSS) vulnerability in entries of type Document.
- risk 0.40cvss 6.1epss 0.01
A potential security vulnerability has been identified in HPE iLO Amplifier Pack. The vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS). HPE has provided the following software update to resolve the vulnerability in HPE iLO Amplifier Pack: HPE iLO…
- risk 0.40cvss 6.1epss 0.01
Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727.