CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 853 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-28707 | Med | 0.40 | 6.1 | 0.01 | Jan 19, 2021 | The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage() event is not validated. The… | ||
| CVE-2021-3184 | Med | 0.40 | 6.1 | 0.01 | Jan 19, 2021 | MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button. | ||
| CVE-2021-25325 | Med | 0.40 | 6.1 | 0.01 | Jan 19, 2021 | MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs. | ||
| CVE-2021-25324 | Med | 0.40 | 6.1 | 0.01 | Jan 19, 2021 | MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp. | ||
| CVE-2021-25295 | Med | 0.40 | 6.1 | 0.02 | Jan 18, 2021 | OpenCATS through 0.9.5-3 has multiple Cross-site Scripting (XSS) issues. | ||
| CVE-2020-15864 | Med | 0.40 | 6.1 | 0.01 | Jan 17, 2021 | An issue was discovered in Quali CloudShell 9.3. An XSS vulnerability in the login page allows an attacker to craft a URL, with a constructor.constructor substring in the username field, that executes a payload when the user visits the /Account/Login page. | ||
| CVE-2020-16255 | Med | 0.40 | 6.1 | 0.01 | Jan 15, 2021 | ownCloud (Core) before 10.5 allows XSS in login page 'forgot password.' | ||
| CVE-2020-16046 | Med | 0.40 | 6.1 | 0.01 | Jan 14, 2021 | Script injection in iOSWeb in Google Chrome on iOS prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code via a crafted HTML page. | ||
| CVE-2021-23936 | Med | 0.40 | 6.1 | 0.01 | Jan 12, 2021 | OX App Suite through 7.10.4 allows XSS via the subject of a task. | ||
| CVE-2021-23935 | Med | 0.40 | 6.1 | 0.01 | Jan 12, 2021 | OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code. | ||
| CVE-2021-23934 | Med | 0.40 | 6.1 | 0.01 | Jan 12, 2021 | OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code. | ||
| CVE-2021-23933 | Med | 0.40 | 6.1 | 0.01 | Jan 12, 2021 | OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL. | ||
| CVE-2021-23932 | Med | 0.40 | 6.1 | 0.01 | Jan 12, 2021 | OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename. | ||
| CVE-2021-23931 | Med | 0.40 | 6.1 | 0.01 | Jan 12, 2021 | OX App Suite through 7.10.4 allows XSS via an inline binary file. | ||
| CVE-2021-23930 | Med | 0.40 | 6.1 | 0.01 | Jan 12, 2021 | OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile. | ||
| CVE-2021-23929 | Med | 0.40 | 6.1 | 0.01 | Jan 12, 2021 | OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/?delivery=view URI. | ||
| CVE-2021-23928 | Med | 0.40 | 6.1 | 0.01 | Jan 12, 2021 | OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string. | ||
| CVE-2021-23125 | Med | 0.40 | 6.1 | 0.01 | Jan 12, 2021 | An issue was discovered in Joomla! 3.1.0 through 3.9.23. The lack of escaping of image-related parameters in multiple com_tags views cause lead to XSS attack vectors. | ||
| CVE-2020-26713 | Med | 0.40 | 6.1 | 0.01 | Jan 12, 2021 | REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The information submitted by the user is immediately returned in the response and not escaped leading to the reflected XSS vulnerability. Attackers can exploit vulnerabilities to steal login… | ||
| CVE-2020-24701 | Med | 0.40 | 6.1 | 0.07 | Jan 12, 2021 | OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI). |
- risk 0.40cvss 6.1epss 0.01
The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage() event is not validated. The…
- risk 0.40cvss 6.1epss 0.01
MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button.
- risk 0.40cvss 6.1epss 0.01
MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs.
- risk 0.40cvss 6.1epss 0.01
MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp.
- risk 0.40cvss 6.1epss 0.02
OpenCATS through 0.9.5-3 has multiple Cross-site Scripting (XSS) issues.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Quali CloudShell 9.3. An XSS vulnerability in the login page allows an attacker to craft a URL, with a constructor.constructor substring in the username field, that executes a payload when the user visits the /Account/Login page.
- risk 0.40cvss 6.1epss 0.01
ownCloud (Core) before 10.5 allows XSS in login page 'forgot password.'
- risk 0.40cvss 6.1epss 0.01
Script injection in iOSWeb in Google Chrome on iOS prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.4 allows XSS via the subject of a task.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.4 allows XSS via an inline binary file.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/?delivery=view URI.
- risk 0.40cvss 6.1epss 0.01
OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Joomla! 3.1.0 through 3.9.23. The lack of escaping of image-related parameters in multiple com_tags views cause lead to XSS attack vectors.
- risk 0.40cvss 6.1epss 0.01
REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The information submitted by the user is immediately returned in the response and not escaped leading to the reflected XSS vulnerability. Attackers can exploit vulnerabilities to steal login…
- risk 0.40cvss 6.1epss 0.07
OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI).