CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 849 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-24124 | Med | 0.40 | 6.1 | 0.01 | Mar 18, 2021 | Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site Scripting (XSS) when the CAPTCHA page is shown could lead to privileged escalation. | ||
| CVE-2021-20629 | Med | 0.40 | 6.1 | 0.01 | Mar 18, 2021 | Cross-site scripting vulnerability in E-mail of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors. | ||
| CVE-2021-20628 | Med | 0.40 | 6.1 | 0.01 | Mar 18, 2021 | Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors. Note that this vulnerability occurs only when using Mozilla Firefox. | ||
| CVE-2021-20627 | Med | 0.40 | 6.1 | 0.01 | Mar 18, 2021 | Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors. | ||
| CVE-2019-18233 | Med | 0.40 | 6.1 | 0.01 | Mar 17, 2021 | In Advantech Spectre RT Industrial Routers ERT351 5.1.3 and prior, the affected product does not neutralize special characters in the error response, allowing attackers to use a reflected XSS attack. | ||
| CVE-2021-27938 | Med | 0.40 | 6.1 | 0.01 | Mar 16, 2021 | A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module. A Cross Site Scripting vulnerability allows an attacker to inject an arbitrary payload in the CreateQueuedJobTask dev task via a specially crafted URL. | ||
| CVE-2021-3150 | Med | 0.40 | 6.1 | 0.01 | Mar 15, 2021 | A cross-site scripting (XSS) vulnerability on the Delete Personal Data page in Cryptshare Server before 4.8.0 allows an attacker to inject arbitrary web script or HTML via the user name. The issue is fixed with the version 4.8.1 | ||
| CVE-2021-27949 | Med | 0.40 | 6.1 | 0.01 | Mar 15, 2021 | Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools. | ||
| CVE-2021-26924 | Med | 0.40 | 6.1 | 0.01 | Mar 15, 2021 | An issue was discovered in Argo CD before 1.8.4. Browser XSS protection is not activated due to the missing XSS protection header. | ||
| CVE-2021-28161 | Med | 0.40 | 6.1 | 0.01 | Mar 12, 2021 | In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected. | ||
| CVE-2021-21080 | Med | 0.40 | 6.1 | 0.01 | Mar 12, 2021 | Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript content that may be executed within the context of the victim's browser when they browse to… | ||
| CVE-2021-21079 | Med | 0.40 | 6.1 | 0.01 | Mar 12, 2021 | Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript content that may be executed within the context of the victim's browser when they browse to… | ||
| CVE-2021-28007 | Med | 0.40 | 6.1 | 0.01 | Mar 10, 2021 | Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in register.php through the name parameter. | ||
| CVE-2021-20672 | Med | 0.40 | 6.1 | 0.01 | Mar 10, 2021 | Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote attackers to inject an arbitrary script via unspecified vectors. | ||
| CVE-2020-13959 | Med | 0.40 | 6.1 | 0.06 | Mar 10, 2021 | The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow… | ||
| CVE-2021-28115 | Med | 0.40 | 6.1 | 0.01 | Mar 9, 2021 | The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS via the comment field of feedback during an edit operation. | ||
| CVE-2021-28006 | Med | 0.40 | 6.1 | 0.01 | Mar 9, 2021 | Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in admin.php through the options parameter. | ||
| CVE-2021-21325 | Med | 0.40 | 6.2 | 0.01 | Mar 8, 2021 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 a new budget type can be defined by user. This input is not correctly filtered. This results in a… | ||
| CVE-2021-26967 | Med | 0.40 | 6.1 | 0.01 | Mar 5, 2021 | A remote reflected cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the web-based management interface of AirWave could allow a remote attacker to conduct a reflected cross-site… | ||
| CVE-2020-35594 | Med | 0.40 | 6.1 | 0.01 | Mar 5, 2021 | Zoho ManageEngine ADManager Plus before 7066 allows XSS. |
- risk 0.40cvss 6.1epss 0.01
Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site Scripting (XSS) when the CAPTCHA page is shown could lead to privileged escalation.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in E-mail of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors. Note that this vulnerability occurs only when using Mozilla Firefox.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
In Advantech Spectre RT Industrial Routers ERT351 5.1.3 and prior, the affected product does not neutralize special characters in the error response, allowing attackers to use a reflected XSS attack.
- risk 0.40cvss 6.1epss 0.01
A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module. A Cross Site Scripting vulnerability allows an attacker to inject an arbitrary payload in the CreateQueuedJobTask dev task via a specially crafted URL.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability on the Delete Personal Data page in Cryptshare Server before 4.8.0 allows an attacker to inject arbitrary web script or HTML via the user name. The issue is fixed with the version 4.8.1
- risk 0.40cvss 6.1epss 0.01
Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Argo CD before 1.8.4. Browser XSS protection is not activated due to the missing XSS protection header.
- risk 0.40cvss 6.1epss 0.01
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.
- risk 0.40cvss 6.1epss 0.01
Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript content that may be executed within the context of the victim's browser when they browse to…
- risk 0.40cvss 6.1epss 0.01
Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript content that may be executed within the context of the victim's browser when they browse to…
- risk 0.40cvss 6.1epss 0.01
Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in register.php through the name parameter.
- risk 0.40cvss 6.1epss 0.01
Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote attackers to inject an arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.06
The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow…
- risk 0.40cvss 6.1epss 0.01
The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS via the comment field of feedback during an edit operation.
- risk 0.40cvss 6.1epss 0.01
Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in admin.php through the options parameter.
- risk 0.40cvss 6.2epss 0.01
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 a new budget type can be defined by user. This input is not correctly filtered. This results in a…
- risk 0.40cvss 6.1epss 0.01
A remote reflected cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the web-based management interface of AirWave could allow a remote attacker to conduct a reflected cross-site…
- risk 0.40cvss 6.1epss 0.01
Zoho ManageEngine ADManager Plus before 7066 allows XSS.