CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 854 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-23849 | Med | 0.40 | 6.1 | 0.01 | Jan 11, 2021 | Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript. | ||
| CVE-2020-23644 | Med | 0.40 | 6.1 | 0.01 | Jan 11, 2021 | XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg={XSS] to Home/c/ErrorController.php. | ||
| CVE-2020-23643 | Med | 0.40 | 6.1 | 0.01 | Jan 11, 2021 | XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr={XSS] to Home/c/WechatController.php. | ||
| CVE-2020-35726 | Med | 0.40 | 6.1 | 0.02 | Jan 11, 2021 | Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Reports/index.jsp file via the by parameter. NOTE: This vulnerability only affects products that are no… | ||
| CVE-2020-35725 | Med | 0.40 | 6.1 | 0.02 | Jan 11, 2021 | Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/index.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported by the… | ||
| CVE-2020-35719 | Med | 0.40 | 6.1 | 0.02 | Jan 11, 2021 | Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Search/index.jsp file via the added parameter. NOTE: This vulnerability only affects products that are no… | ||
| CVE-2020-35206 | Med | 0.40 | 6.1 | 0.01 | Jan 11, 2021 | Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the cConn.jsp file via the ur parameter. NOTE: This vulnerability only affects products that are no… | ||
| CVE-2020-35204 | Med | 0.40 | 6.1 | 0.01 | Jan 11, 2021 | Reflected XSS in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the PolicyAuthority/Common/FolderControl.jsp file via the unqID parameter. NOTE: This vulnerability only affects products that are… | ||
| CVE-2020-35203 | Med | 0.40 | 6.1 | 0.01 | Jan 11, 2021 | Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the initFile.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no… | ||
| CVE-2020-16030 | Med | 0.40 | 6.1 | 0.01 | Jan 8, 2021 | Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. | ||
| CVE-2020-25476 | Med | 0.40 | 6.1 | 0.01 | Jan 7, 2021 | Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar. An attacker can insert the malicious payload on the username, lastname or surname fields of its own profile, and the malicious… | ||
| CVE-2020-24903 | Med | 0.40 | 6.1 | 0.03 | Jan 7, 2021 | Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the… | ||
| CVE-2020-24901 | Med | 0.40 | 6.1 | 0.04 | Jan 7, 2021 | The default installation of Krpano Panorama Viewer version <=1.20.8 is vulnerable to Reflected XSS due to insecure remote js load in file viewer/krpano.html, parameter plugin[test].url. | ||
| CVE-2020-24900 | Med | 0.40 | 6.1 | 0.01 | Jan 7, 2021 | The default installation of Krpano Panorama Viewer version <=1.20.8 is prone to Reflected XSS due to insecure XML load in file /viewer/krpano.html, parameter xml. | ||
| CVE-2020-35262 | Med | 0.40 | 6.1 | 0.01 | Jan 6, 2021 | Cross Site Scripting (XSS) vulnerability in Digisol DG-HR3400 can be exploited via the NTP server name in Time and date module and "Keyword" in URL Filter. | ||
| CVE-2020-8160 | Med | 0.40 | 6.1 | 0.01 | Jan 6, 2021 | MendixSSO <= 2.1.1 contains endpoints that make use of the openid handler, which is suffering from a Cross-Site Scripting vulnerability via the URL path. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a… | ||
| CVE-2020-36172 | Med | 0.40 | 6.1 | 0.01 | Jan 6, 2021 | The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS. | ||
| CVE-2020-36171 | Med | 0.40 | 6.1 | 0.01 | Jan 6, 2021 | The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads. | ||
| CVE-2021-3026 | Med | 0.40 | 6.1 | 0.01 | Jan 5, 2021 | Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment. | ||
| CVE-2021-3014 | Med | 0.40 | 6.1 | 0.01 | Jan 4, 2021 | In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter. |
- risk 0.40cvss 6.1epss 0.01
Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.
- risk 0.40cvss 6.1epss 0.01
XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg={XSS] to Home/c/ErrorController.php.
- risk 0.40cvss 6.1epss 0.01
XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr={XSS] to Home/c/WechatController.php.
- risk 0.40cvss 6.1epss 0.02
Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Reports/index.jsp file via the by parameter. NOTE: This vulnerability only affects products that are no…
- risk 0.40cvss 6.1epss 0.02
Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/index.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported by the…
- risk 0.40cvss 6.1epss 0.02
Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Search/index.jsp file via the added parameter. NOTE: This vulnerability only affects products that are no…
- risk 0.40cvss 6.1epss 0.01
Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the cConn.jsp file via the ur parameter. NOTE: This vulnerability only affects products that are no…
- risk 0.40cvss 6.1epss 0.01
Reflected XSS in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the PolicyAuthority/Common/FolderControl.jsp file via the unqID parameter. NOTE: This vulnerability only affects products that are…
- risk 0.40cvss 6.1epss 0.01
Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the initFile.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no…
- risk 0.40cvss 6.1epss 0.01
Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
- risk 0.40cvss 6.1epss 0.01
Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar. An attacker can insert the malicious payload on the username, lastname or surname fields of its own profile, and the malicious…
- risk 0.40cvss 6.1epss 0.03
Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the…
- risk 0.40cvss 6.1epss 0.04
The default installation of Krpano Panorama Viewer version <=1.20.8 is vulnerable to Reflected XSS due to insecure remote js load in file viewer/krpano.html, parameter plugin[test].url.
- risk 0.40cvss 6.1epss 0.01
The default installation of Krpano Panorama Viewer version <=1.20.8 is prone to Reflected XSS due to insecure XML load in file /viewer/krpano.html, parameter xml.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) vulnerability in Digisol DG-HR3400 can be exploited via the NTP server name in Time and date module and "Keyword" in URL Filter.
- risk 0.40cvss 6.1epss 0.01
MendixSSO <= 2.1.1 contains endpoints that make use of the openid handler, which is suffering from a Cross-Site Scripting vulnerability via the URL path. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a…
- risk 0.40cvss 6.1epss 0.01
The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.
- risk 0.40cvss 6.1epss 0.01
The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads.
- risk 0.40cvss 6.1epss 0.01
Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment.
- risk 0.40cvss 6.1epss 0.01
In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter.