CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 860 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-29137 | Med | 0.40 | 6.1 | 0.01 | Nov 27, 2020 | cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577). | ||
| CVE-2020-29133 | Med | 0.40 | 6.1 | 0.01 | Nov 27, 2020 | jsp/upload.jsp in Coremail XT 5.0 allows XSS via an uploaded personal signature, as demonstrated by a .jpg.html filename in the signImgFile parameter. | ||
| CVE-2020-29053 | Med | 0.40 | 6.1 | 0.01 | Nov 24, 2020 | HRSALE 2.0.0 allows XSS via the admin/project/projects_calendar set_date parameter. | ||
| CVE-2020-25474 | Med | 0.40 | 6.1 | 0.01 | Nov 24, 2020 | SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Scripting (XSS) vulnerability via the editor_name parameter. | ||
| CVE-2020-26227 | Med | 0.40 | 6.1 | 0.01 | Nov 23, 2020 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 the system extension Fluid (typo3/cms-fluid) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers.… | ||
| CVE-2020-28927 | Med | 0.40 | 6.1 | 0.01 | Nov 23, 2020 | There is a Stored XSS in Magicpin v2.1 in the User Registration section. Each time an admin visits the manage user section from the admin panel, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload. | ||
| CVE-2020-28350 | Med | 0.40 | 6.1 | 0.01 | Nov 19, 2020 | A Cross Site Scripting (XSS) vulnerability exists in OPAC in Sokrates SOWA SowaSQL through 5.6.1 via the sowacgi.php typ parameter. | ||
| CVE-2020-28210 | Med | 0.40 | 6.1 | 0.01 | Nov 19, 2020 | A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoStruxure Building Operation WebStation V2.0 - V3.1 that could cause an attacker to inject HTML and JavaScript code into the user's browser. | ||
| CVE-2020-28947 | Med | 0.40 | 6.1 | 0.01 | Nov 19, 2020 | In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled. | ||
| CVE-2020-22394 | Med | 0.40 | 6.1 | 0.01 | Nov 19, 2020 | In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability. | ||
| CVE-2020-22723 | Med | 0.40 | 6.1 | 0.01 | Nov 18, 2020 | A cross-site scripting (XSS) vulnerability in Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop version 1.14 allows remote attackers to inject arbitrary web script or HTML via user.php by registering an account directly in the user center, and then adding the payload to… | ||
| CVE-2020-27126 | Med | 0.40 | 6.1 | 0.01 | Nov 18, 2020 | A vulnerability in an API of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to improper validation of user-supplied input to an application programmatic interface (API) within Cisco Webex… | ||
| CVE-2020-26554 | Med | 0.40 | 6.1 | 0.01 | Nov 18, 2020 | REDDOXX MailDepot 2033 (aka 2.3.3022) allows XSS via an incoming HTML e-mail message. | ||
| CVE-2020-28129 | Med | 0.40 | 6.1 | 0.01 | Nov 17, 2020 | Stored Cross-site scripting (XSS) vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php?page=packages via vulnerable fields 'Package Name' and 'Description'. | ||
| CVE-2020-25890 | Med | 0.40 | 6.1 | 0.02 | Nov 17, 2020 | The web application of Kyocera printer (ECOSYS M2640IDW) is affected by Stored XSS vulnerability, discovered in the addition a new contact in "Machine Address Book". Successful exploitation of this vulnerability can lead to session hijacking of the administrator in the web… | ||
| CVE-2020-28139 | Med | 0.40 | 6.1 | 0.01 | Nov 17, 2020 | SourceCodester Online Clothing Store 1.0 is affected by a cross-site scripting (XSS) vulnerability via a Offer Detail field in offer.php. | ||
| CVE-2020-11860 | Med | 0.40 | 6.1 | 0.01 | Nov 17, 2020 | Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS) | ||
| CVE-2020-27459 | Med | 0.40 | 6.1 | 0.01 | Nov 16, 2020 | Chronoforeum 2.0.11 allows Stored XSS vulnerabilities when inserting a crafted payload into a post. If any user sees the post, the inserted XSS code is executed. | ||
| CVE-2020-26825 | Med | 0.40 | 6.1 | 0.01 | Nov 13, 2020 | SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user (victim), because News tile does not sufficiently encode user… | ||
| CVE-2020-27193 | Med | 0.40 | 6.1 | 0.02 | Nov 12, 2020 | A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs. |
- risk 0.40cvss 6.1epss 0.01
cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).
- risk 0.40cvss 6.1epss 0.01
jsp/upload.jsp in Coremail XT 5.0 allows XSS via an uploaded personal signature, as demonstrated by a .jpg.html filename in the signImgFile parameter.
- risk 0.40cvss 6.1epss 0.01
HRSALE 2.0.0 allows XSS via the admin/project/projects_calendar set_date parameter.
- risk 0.40cvss 6.1epss 0.01
SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Scripting (XSS) vulnerability via the editor_name parameter.
- risk 0.40cvss 6.1epss 0.01
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 the system extension Fluid (typo3/cms-fluid) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers.…
- risk 0.40cvss 6.1epss 0.01
There is a Stored XSS in Magicpin v2.1 in the User Registration section. Each time an admin visits the manage user section from the admin panel, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.
- risk 0.40cvss 6.1epss 0.01
A Cross Site Scripting (XSS) vulnerability exists in OPAC in Sokrates SOWA SowaSQL through 5.6.1 via the sowacgi.php typ parameter.
- risk 0.40cvss 6.1epss 0.01
A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoStruxure Building Operation WebStation V2.0 - V3.1 that could cause an attacker to inject HTML and JavaScript code into the user's browser.
- risk 0.40cvss 6.1epss 0.01
In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled.
- risk 0.40cvss 6.1epss 0.01
In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop version 1.14 allows remote attackers to inject arbitrary web script or HTML via user.php by registering an account directly in the user center, and then adding the payload to…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in an API of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to improper validation of user-supplied input to an application programmatic interface (API) within Cisco Webex…
- risk 0.40cvss 6.1epss 0.01
REDDOXX MailDepot 2033 (aka 2.3.3022) allows XSS via an incoming HTML e-mail message.
- risk 0.40cvss 6.1epss 0.01
Stored Cross-site scripting (XSS) vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php?page=packages via vulnerable fields 'Package Name' and 'Description'.
- risk 0.40cvss 6.1epss 0.02
The web application of Kyocera printer (ECOSYS M2640IDW) is affected by Stored XSS vulnerability, discovered in the addition a new contact in "Machine Address Book". Successful exploitation of this vulnerability can lead to session hijacking of the administrator in the web…
- risk 0.40cvss 6.1epss 0.01
SourceCodester Online Clothing Store 1.0 is affected by a cross-site scripting (XSS) vulnerability via a Offer Detail field in offer.php.
- risk 0.40cvss 6.1epss 0.01
Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS)
- risk 0.40cvss 6.1epss 0.01
Chronoforeum 2.0.11 allows Stored XSS vulnerabilities when inserting a crafted payload into a post. If any user sees the post, the inserted XSS code is executed.
- risk 0.40cvss 6.1epss 0.01
SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user (victim), because News tile does not sufficiently encode user…
- risk 0.40cvss 6.1epss 0.02
A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.