CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 848 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-23006 | Med | 0.40 | 6.1 | 0.01 | Mar 31, 2021 | On all 7.x and 6.x versions (fixed in 8.0.0), undisclosed BIG-IQ pages have a reflected cross-site scripting vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. | ||
| CVE-2021-22994 | Med | 0.40 | 6.1 | 0.01 | Mar 31, 2021 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise… | ||
| CVE-2020-19643 | Med | 0.40 | 6.1 | 0.01 | Mar 30, 2021 | Cross Site Scripting (XSS) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in the FTP settings page to the "goform/formSetFtpCfg" settings page. | ||
| CVE-2021-29267 | Med | 0.40 | 6.1 | 0.01 | Mar 29, 2021 | Sherlock SherlockIM through 2021-03-29 allows Cross Site Scripting (XSS) by leveraging the api/Files/Attachment URI to attack help-desk staff via the chatbot feature. | ||
| CVE-2021-29274 | Med | 0.40 | 6.1 | 0.01 | Mar 29, 2021 | Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip. | ||
| CVE-2021-29271 | Med | 0.40 | 6.1 | 0.01 | Mar 27, 2021 | remark42 before 1.6.1 allows XSS, as demonstrated by "Locator: Locator{URL:" followed by an XSS payload. This is related to backend/app/store/comment.go and backend/app/store/service/service.go. | ||
| CVE-2021-22886 | Med | 0.40 | 6.1 | 0.02 | Mar 26, 2021 | Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app. | ||
| CVE-2020-25840 | Med | 0.40 | 6.1 | 0.01 | Mar 26, 2021 | Cross-Site scripting vulnerability in Micro Focus Access Manager product, affects all version prior to version 5.0. The vulnerability could cause configuration destruction. | ||
| CVE-2021-3275 | Med | 0.40 | 6.1 | 0.02 | Mar 26, 2021 | Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices… | ||
| CVE-2020-23517 | Med | 0.40 | 6.1 | 0.07 | Mar 26, 2021 | Cross Site Scripting (XSS) vulnerability in Aryanic HighMail (High CMS) versions 2020 and before allows remote attackers to inject arbitrary web script or HTML, via 'user' to LoginForm. | ||
| CVE-2021-27310 | Med | 0.40 | 6.1 | 0.03 | Mar 23, 2021 | Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "language" parameter. | ||
| CVE-2021-27309 | Med | 0.40 | 6.1 | 0.02 | Mar 23, 2021 | Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "module" parameter. | ||
| CVE-2021-25922 | Med | 0.40 | 6.1 | 0.01 | Mar 22, 2021 | In OpenEMR, versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly. An attacker could trick a user to click on a malicious url and execute malicious code. | ||
| CVE-2021-25277 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2021 | FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the alternative text hover box in the file submission component. | ||
| CVE-2021-28126 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2021 | index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerability | ||
| CVE-2021-28109 | Med | 0.40 | 6.1 | 0.01 | Mar 19, 2021 | TranzWare (POI) FIMI before 4.2.20.4.2 allows login_tw.php reflected Cross-Site Scripting (XSS). | ||
| CVE-2021-27436 | Med | 0.40 | 6.1 | 0.01 | Mar 18, 2021 | WebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code to an unsuspecting user, which could result in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage… | ||
| CVE-2021-28160 | Med | 0.40 | 6.1 | 0.01 | Mar 18, 2021 | Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) suffers from a reflected XSS vulnerability due to unsanitized SSID value when the latter is displayed in the /repeater.html page ("Repeater Wizard" homepage section). | ||
| CVE-2021-28796 | Med | 0.40 | 6.1 | 0.01 | Mar 18, 2021 | Increments Qiita::Markdown before 0.33.0 allows XSS in transformers. | ||
| CVE-2021-24135 | Med | 0.40 | 6.1 | 0.01 | Mar 18, 2021 | Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary JavaScript code or HTML. |
- risk 0.40cvss 6.1epss 0.01
On all 7.x and 6.x versions (fixed in 8.0.0), undisclosed BIG-IQ pages have a reflected cross-site scripting vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
- risk 0.40cvss 6.1epss 0.01
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise…
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in the FTP settings page to the "goform/formSetFtpCfg" settings page.
- risk 0.40cvss 6.1epss 0.01
Sherlock SherlockIM through 2021-03-29 allows Cross Site Scripting (XSS) by leveraging the api/Files/Attachment URI to attack help-desk staff via the chatbot feature.
- risk 0.40cvss 6.1epss 0.01
Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.
- risk 0.40cvss 6.1epss 0.01
remark42 before 1.6.1 allows XSS, as demonstrated by "Locator: Locator{URL:" followed by an XSS payload. This is related to backend/app/store/comment.go and backend/app/store/service/service.go.
- risk 0.40cvss 6.1epss 0.02
Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.
- risk 0.40cvss 6.1epss 0.01
Cross-Site scripting vulnerability in Micro Focus Access Manager product, affects all version prior to version 5.0. The vulnerability could cause configuration destruction.
- risk 0.40cvss 6.1epss 0.02
Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices…
- risk 0.40cvss 6.1epss 0.07
Cross Site Scripting (XSS) vulnerability in Aryanic HighMail (High CMS) versions 2020 and before allows remote attackers to inject arbitrary web script or HTML, via 'user' to LoginForm.
- risk 0.40cvss 6.1epss 0.03
Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "language" parameter.
- risk 0.40cvss 6.1epss 0.02
Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "module" parameter.
- risk 0.40cvss 6.1epss 0.01
In OpenEMR, versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly. An attacker could trick a user to click on a malicious url and execute malicious code.
- risk 0.40cvss 6.1epss 0.01
FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the alternative text hover box in the file submission component.
- risk 0.40cvss 6.1epss 0.01
index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerability
- risk 0.40cvss 6.1epss 0.01
TranzWare (POI) FIMI before 4.2.20.4.2 allows login_tw.php reflected Cross-Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.01
WebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code to an unsuspecting user, which could result in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage…
- risk 0.40cvss 6.1epss 0.01
Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) suffers from a reflected XSS vulnerability due to unsanitized SSID value when the latter is displayed in the /repeater.html page ("Repeater Wizard" homepage section).
- risk 0.40cvss 6.1epss 0.01
Increments Qiita::Markdown before 0.33.0 allows XSS in transformers.
- risk 0.40cvss 6.1epss 0.01
Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary JavaScript code or HTML.