CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 851 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-13697 | Med | 0.40 | 6.1 | 0.01 | Feb 23, 2021 | An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to… | ||
| CVE-2020-35852 | Med | 0.40 | 6.1 | 0.01 | Feb 23, 2021 | Chatbox is affected by cross-site scripting (XSS). An attacker has to upload any XSS payload with SVG, XML file in Chatbox. There is no restriction on file upload in Chatbox which leads to stored XSS. | ||
| CVE-2020-19762 | Med | 0.40 | 6.1 | 0.01 | Feb 22, 2021 | Automated Logic Corporation (ALC) WebCTRL System 6.5 and prior allows remote attackers to execute any JavaScript code via a XSS payload for the first parameter in a GET request. | ||
| CVE-2020-35664 | Med | 0.40 | 6.1 | 0.01 | Feb 22, 2021 | An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. There is cross-site scripting (XSS) in the console. | ||
| CVE-2021-26716 | Med | 0.40 | 6.1 | 0.01 | Feb 21, 2021 | Modules/input/Views/schedule.php in Emoncms through 10.2.7 allows XSS via the node parameter. | ||
| CVE-2021-27214 | Med | 0.40 | 6.1 | 0.02 | Feb 19, 2021 | A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting (XSS) attack against the administrative… | ||
| CVE-2021-26746 | Med | 0.40 | 6.1 | 0.01 | Feb 19, 2021 | Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI. | ||
| CVE-2021-27403 | Med | 0.40 | 6.1 | 0.01 | Feb 19, 2021 | Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow cgi-bin/te_acceso_router.cgi curWebPage XSS. | ||
| CVE-2021-20444 | Med | 0.40 | 6.1 | 0.01 | Feb 18, 2021 | IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2021-1351 | Med | 0.40 | 6.1 | 0.01 | Feb 17, 2021 | A vulnerability in the web-based interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of the affected service. The vulnerability is due to insufficient… | ||
| CVE-2020-2502 | Med | 0.40 | 6.1 | 0.01 | Feb 17, 2021 | This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. Photo Station 6.0.11 and later | ||
| CVE-2020-35569 | Med | 0.40 | 6.1 | 0.01 | Feb 16, 2021 | An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is a self XSS issue with a crafted cookie in the login page. | ||
| CVE-2020-36236 | Med | 0.40 | 6.1 | 0.01 | Feb 15, 2021 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the ViewWorkflowSchemes.jspa and ListWorkflows.jspa endpoints. The affected versions are before version… | ||
| CVE-2021-22979 | Med | 0.40 | 6.1 | 0.01 | Feb 12, 2021 | On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility when Fraud Protection… | ||
| CVE-2020-24842 | Med | 0.40 | 6.1 | 0.01 | Feb 10, 2021 | PNPSCADA 2.200816204020 allows cross-site scripting (XSS), which can execute arbitrary JavaScript in the victim's browser. | ||
| CVE-2020-29171 | Med | 0.40 | 6.1 | 0.01 | Feb 10, 2021 | Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-security-and-firewall) plugin before 4.4.6 for WordPress. | ||
| CVE-2020-22839 | Med | 0.40 | 6.1 | 0.05 | Feb 9, 2021 | Reflected cross-site scripting vulnerability (XSS) in the evoadm.php file in b2evolution cms version 6.11.6-stable allows remote attackers to inject arbitrary webscript or HTML code via the tab3 parameter. | ||
| CVE-2021-26916 | Med | 0.40 | 6.1 | 0.01 | Feb 8, 2021 | In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML through the Filters/CheckDiscountCouponAttribute.cs discountcode parameter. | ||
| CVE-2021-22122 | Med | 0.40 | 6.1 | 0.11 | Feb 8, 2021 | An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload in… | ||
| CVE-2020-18737 | Med | 0.40 | 6.1 | 0.01 | Feb 5, 2021 | An issue was discovered in Typora 0.9.67. There is an XSS vulnerability that causes Remote Code Execution. |
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to…
- risk 0.40cvss 6.1epss 0.01
Chatbox is affected by cross-site scripting (XSS). An attacker has to upload any XSS payload with SVG, XML file in Chatbox. There is no restriction on file upload in Chatbox which leads to stored XSS.
- risk 0.40cvss 6.1epss 0.01
Automated Logic Corporation (ALC) WebCTRL System 6.5 and prior allows remote attackers to execute any JavaScript code via a XSS payload for the first parameter in a GET request.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. There is cross-site scripting (XSS) in the console.
- risk 0.40cvss 6.1epss 0.01
Modules/input/Views/schedule.php in Emoncms through 10.2.7 allows XSS via the node parameter.
- risk 0.40cvss 6.1epss 0.02
A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting (XSS) attack against the administrative…
- risk 0.40cvss 6.1epss 0.01
Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI.
- risk 0.40cvss 6.1epss 0.01
Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow cgi-bin/te_acceso_router.cgi curWebPage XSS.
- risk 0.40cvss 6.1epss 0.01
IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of the affected service. The vulnerability is due to insufficient…
- risk 0.40cvss 6.1epss 0.01
This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. Photo Station 6.0.11 and later
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is a self XSS issue with a crafted cookie in the login page.
- risk 0.40cvss 6.1epss 0.01
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the ViewWorkflowSchemes.jspa and ListWorkflows.jspa endpoints. The affected versions are before version…
- risk 0.40cvss 6.1epss 0.01
On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility when Fraud Protection…
- risk 0.40cvss 6.1epss 0.01
PNPSCADA 2.200816204020 allows cross-site scripting (XSS), which can execute arbitrary JavaScript in the victim's browser.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-security-and-firewall) plugin before 4.4.6 for WordPress.
- risk 0.40cvss 6.1epss 0.05
Reflected cross-site scripting vulnerability (XSS) in the evoadm.php file in b2evolution cms version 6.11.6-stable allows remote attackers to inject arbitrary webscript or HTML code via the tab3 parameter.
- risk 0.40cvss 6.1epss 0.01
In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML through the Filters/CheckDiscountCouponAttribute.cs discountcode parameter.
- risk 0.40cvss 6.1epss 0.11
An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload in…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Typora 0.9.67. There is an XSS vulnerability that causes Remote Code Execution.