CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 864 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-25272 | Med | 0.40 | 6.1 | 0.01 | Oct 8, 2020 | In SourceCodester Online Bus Booking System 1.0, there is XSS through the name parameter in book_now.php. | ||
| CVE-2019-4725 | Med | 0.40 | 6.1 | 0.01 | Oct 6, 2020 | IBM Security Access Manager Appliance 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM… | ||
| CVE-2020-23832 | Med | 0.40 | 6.1 | 0.02 | Oct 6, 2020 | A Persistent Cross-Site Scripting (XSS) vulnerability in message_admin.php in Projectworlds Car Rental Management System v1.0 allows unauthenticated remote attackers to harvest an admin login session cookie and steal an admin session upon an admin login. | ||
| CVE-2020-5631 | Med | 0.40 | 6.1 | 0.01 | Oct 6, 2020 | Stored cross-site scripting vulnerability in CMONOS.JP ver2.0.20191009 and earlier allows remote attackers to inject arbitrary script via unspecified vectors. | ||
| CVE-2020-26135 | Med | 0.40 | 6.1 | 0.01 | Oct 2, 2020 | Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO. | ||
| CVE-2020-26134 | Med | 0.40 | 6.1 | 0.01 | Oct 2, 2020 | Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via BBCode. | ||
| CVE-2020-14294 | Med | 0.40 | 6.1 | 0.01 | Oct 2, 2020 | An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when reading transfer comments or the global notice board. | ||
| CVE-2020-13168 | Med | 0.40 | 6.1 | 0.01 | Oct 2, 2020 | SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter. | ||
| CVE-2020-26523 | Med | 0.40 | 6.1 | 0.01 | Oct 2, 2020 | Froala Editor before 3.2.2 allows XSS via pasted content. | ||
| CVE-2020-5785 | Med | 0.40 | 6.1 | 0.01 | Oct 1, 2020 | Insufficient output sanitization in Teltonika firmware TRB2_R_00.02.04.3 allows an unauthenticated attacker to conduct reflected cross-site scripting via a crafted ‘action’ or ‘pkg_name’ parameter. | ||
| CVE-2020-14223 | Med | 0.40 | 6.1 | 0.01 | Oct 1, 2020 | HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS). The vulnerability could be employed in a reflected or non-persistent XSS attack. | ||
| CVE-2020-15676 | Med | 0.40 | 6.1 | 0.02 | Oct 1, 2020 | Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and… | ||
| CVE-2019-19393 | Med | 0.40 | 6.1 | 0.01 | Oct 1, 2020 | The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browser-interpreted content (such as JavaScript or other… | ||
| CVE-2020-25626 | Med | 0.40 | 6.1 | 0.01 | Sep 30, 2020 | A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject… | ||
| CVE-2020-8238 | Med | 0.40 | 6.1 | 0.02 | Sep 30, 2020 | A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS). | ||
| CVE-2020-26043 | Med | 0.40 | 6.1 | 0.01 | Sep 30, 2020 | An issue was discovered in Hoosk CMS v1.8.0. There is a XSS vulnerability in install/index.php | ||
| CVE-2020-25761 | Med | 0.40 | 6.1 | 0.02 | Sep 30, 2020 | Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request parameters. An attacker can inject javascript payloads in the parameters to perform various attacks such as stealing of cookies,sensitive… | ||
| CVE-2020-22481 | Med | 0.40 | 6.1 | 0.01 | Sep 30, 2020 | An issue was discovered in HFish 0.5.1. When a payload is inserted where the password is entered, XSS code is triggered when the administrator views the information. | ||
| CVE-2020-26120 | Med | 0.40 | 6.1 | 0.01 | Sep 27, 2020 | XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway. Using crafted HTML, an attacker can elicit an XSS attack via jQuery's parseHTML method, which can cause image… | ||
| CVE-2020-25828 | Med | 0.40 | 6.1 | 0.01 | Sep 27, 2020 | An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be based on user… |
- risk 0.40cvss 6.1epss 0.01
In SourceCodester Online Bus Booking System 1.0, there is XSS through the name parameter in book_now.php.
- risk 0.40cvss 6.1epss 0.01
IBM Security Access Manager Appliance 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
- risk 0.40cvss 6.1epss 0.02
A Persistent Cross-Site Scripting (XSS) vulnerability in message_admin.php in Projectworlds Car Rental Management System v1.0 allows unauthenticated remote attackers to harvest an admin login session cookie and steal an admin session upon an admin login.
- risk 0.40cvss 6.1epss 0.01
Stored cross-site scripting vulnerability in CMONOS.JP ver2.0.20191009 and earlier allows remote attackers to inject arbitrary script via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO.
- risk 0.40cvss 6.1epss 0.01
Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via BBCode.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when reading transfer comments or the global notice board.
- risk 0.40cvss 6.1epss 0.01
SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter.
- risk 0.40cvss 6.1epss 0.01
Froala Editor before 3.2.2 allows XSS via pasted content.
- risk 0.40cvss 6.1epss 0.01
Insufficient output sanitization in Teltonika firmware TRB2_R_00.02.04.3 allows an unauthenticated attacker to conduct reflected cross-site scripting via a crafted ‘action’ or ‘pkg_name’ parameter.
- risk 0.40cvss 6.1epss 0.01
HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS). The vulnerability could be employed in a reflected or non-persistent XSS attack.
- risk 0.40cvss 6.1epss 0.02
Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and…
- risk 0.40cvss 6.1epss 0.01
The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browser-interpreted content (such as JavaScript or other…
- risk 0.40cvss 6.1epss 0.01
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject…
- risk 0.40cvss 6.1epss 0.02
A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Hoosk CMS v1.8.0. There is a XSS vulnerability in install/index.php
- risk 0.40cvss 6.1epss 0.02
Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request parameters. An attacker can inject javascript payloads in the parameters to perform various attacks such as stealing of cookies,sensitive…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in HFish 0.5.1. When a payload is inserted where the password is entered, XSS code is triggered when the administrator views the information.
- risk 0.40cvss 6.1epss 0.01
XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway. Using crafted HTML, an attacker can elicit an XSS attack via jQuery's parseHTML method, which can cause image…
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be based on user…