CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 859 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-29258 | Med | 0.40 | 6.1 | 0.01 | Dec 9, 2020 | Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the w parameter to index.php. | ||
| CVE-2020-29257 | Med | 0.40 | 6.1 | 0.01 | Dec 9, 2020 | Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the q parameter to feedback.php. | ||
| CVE-2020-26835 | Med | 0.40 | 6.1 | 0.01 | Dec 9, 2020 | SAP NetWeaver AS ABAP, versions - 740, 750, 751, 752, 753, 754 , does not sufficiently encode URL which allows an attacker to input malicious java script in the URL which could be executed in the browser resulting in Reflected Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2020-26958 | Med | 0.40 | 6.1 | 0.01 | Dec 9, 2020 | Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox <… | ||
| CVE-2020-26956 | Med | 0.40 | 6.1 | 0.01 | Dec 9, 2020 | In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. | ||
| CVE-2020-26951 | Med | 0.40 | 6.1 | 0.01 | Dec 9, 2020 | A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer.… | ||
| CVE-2020-25627 | Med | 0.40 | 6.1 | 0.04 | Dec 9, 2020 | The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed in 3.9.2. | ||
| CVE-2020-14206 | Med | 0.40 | 6.1 | 0.01 | Dec 8, 2020 | The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter). | ||
| CVE-2020-10012 | Med | 0.40 | 6.1 | 0.01 | Dec 8, 2020 | An access issue was addressed with improved access restrictions. This issue is fixed in macOS Big Sur 11.0.1. Processing a maliciously crafted document may lead to a cross site scripting attack. | ||
| CVE-2020-25631 | Med | 0.40 | 6.1 | 0.01 | Dec 8, 2020 | A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8.4 and 3.7 to 3.7.7 where it was possible to include JavaScript in a book's chapter title, which was not escaped on the "Add new chapter" page. This is fixed in 3.9.2, 3.8.5 and 3.7.8. | ||
| CVE-2020-28727 | Med | 0.40 | 6.1 | 0.01 | Dec 7, 2020 | Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to views/bootstrap/class.DropFolderChooser.php. | ||
| CVE-2020-29572 | Med | 0.40 | 6.1 | 0.01 | Dec 6, 2020 | app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field. | ||
| CVE-2020-27409 | Med | 0.40 | 6.1 | 0.01 | Dec 4, 2020 | OpenSIS Community Edition before 7.5 is affected by a cross-site scripting (XSS) vulnerability in SideForStudent.php via the modname parameter. | ||
| CVE-2020-5678 | Med | 0.40 | 6.1 | 0.01 | Dec 3, 2020 | Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors. | ||
| CVE-2020-5677 | Med | 0.40 | 6.1 | 0.01 | Dec 3, 2020 | Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors. | ||
| CVE-2020-5638 | Med | 0.40 | 6.1 | 0.01 | Dec 3, 2020 | Cross-site scripting vulnerability in desknet's NEO (desknet's NEO Small License V5.5 R1.5 and earlier, and desknet's NEO Enterprise License V5.5 R1.5 and earlier) allows remote attackers to inject arbitrary script via unspecified vectors. | ||
| CVE-2020-29239 | Med | 0.40 | 6.1 | 0.00 | Dec 2, 2020 | Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS). This vulnerability can result in an attacker injecting the XSS payload in the User Registration section. When an admin visits the View Detail of Application section from the admin panel, the… | ||
| CVE-2020-29456 | Med | 0.40 | 6.1 | 0.02 | Dec 2, 2020 | Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email… | ||
| CVE-2017-15686 | Med | 0.40 | 6.1 | 0.01 | Nov 27, 2020 | Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies. | ||
| CVE-2017-15682 | Med | 0.40 | 6.1 | 0.01 | Nov 27, 2020 | In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel. |
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the w parameter to index.php.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the q parameter to feedback.php.
- risk 0.40cvss 6.1epss 0.01
SAP NetWeaver AS ABAP, versions - 740, 750, 751, 752, 753, 754 , does not sufficiently encode URL which allows an attacker to input malicious java script in the URL which could be executed in the browser resulting in Reflected Cross-Site Scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox <…
- risk 0.40cvss 6.1epss 0.01
In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
- risk 0.40cvss 6.1epss 0.01
A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer.…
- risk 0.40cvss 6.1epss 0.04
The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed in 3.9.2.
- risk 0.40cvss 6.1epss 0.01
The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter).
- risk 0.40cvss 6.1epss 0.01
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Big Sur 11.0.1. Processing a maliciously crafted document may lead to a cross site scripting attack.
- risk 0.40cvss 6.1epss 0.01
A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8.4 and 3.7 to 3.7.7 where it was possible to include JavaScript in a book's chapter title, which was not escaped on the "Add new chapter" page. This is fixed in 3.9.2, 3.8.5 and 3.7.8.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to views/bootstrap/class.DropFolderChooser.php.
- risk 0.40cvss 6.1epss 0.01
app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field.
- risk 0.40cvss 6.1epss 0.01
OpenSIS Community Edition before 7.5 is affected by a cross-site scripting (XSS) vulnerability in SideForStudent.php via the modname parameter.
- risk 0.40cvss 6.1epss 0.01
Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in desknet's NEO (desknet's NEO Small License V5.5 R1.5 and earlier, and desknet's NEO Enterprise License V5.5 R1.5 and earlier) allows remote attackers to inject arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.00
Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS). This vulnerability can result in an attacker injecting the XSS payload in the User Registration section. When an admin visits the View Detail of Application section from the admin panel, the…
- risk 0.40cvss 6.1epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email…
- risk 0.40cvss 6.1epss 0.01
Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.
- risk 0.40cvss 6.1epss 0.01
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel.