CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 868 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-25093 | Med | 0.40 | 6.1 | 0.01 | Sep 3, 2020 | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in blog.php. within application/views/templates/clothesshop, application/views/templates/onepage, and application/views/templates/redlabel. | ||
| CVE-2020-25092 | Med | 0.40 | 6.1 | 0.01 | Sep 3, 2020 | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in _parts/header.php, within application/views/templates/clothesshop, application/views/templates/greenlabel, and application/views/templates/redlabel. | ||
| CVE-2020-25091 | Med | 0.40 | 6.1 | 0.01 | Sep 3, 2020 | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/vendor/views/add_product.php. | ||
| CVE-2020-25090 | Med | 0.40 | 6.1 | 0.01 | Sep 3, 2020 | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/publish.php. | ||
| CVE-2020-25089 | Med | 0.40 | 6.1 | 0.01 | Sep 3, 2020 | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/discounts.php. | ||
| CVE-2020-25088 | Med | 0.40 | 6.1 | 0.01 | Sep 3, 2020 | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/blog/blogpublish.php. | ||
| CVE-2020-25087 | Med | 0.40 | 6.1 | 0.01 | Sep 3, 2020 | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/languages.php. | ||
| CVE-2020-25086 | Med | 0.40 | 6.1 | 0.01 | Sep 3, 2020 | Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/adminUsers.php. | ||
| CVE-2020-24553 | Med | 0.40 | 6.1 | 0.04 | Sep 2, 2020 | Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header. | ||
| CVE-2020-24604 | Med | 0.40 | 6.1 | 0.01 | Sep 2, 2020 | A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows remote attackers to inject arbitrary web script or HTML via the GET request "searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin",… | ||
| CVE-2020-24602 | Med | 0.40 | 6.1 | 0.01 | Sep 2, 2020 | Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin",… | ||
| CVE-2020-24601 | Med | 0.40 | 6.1 | 0.01 | Sep 2, 2020 | In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnerable POST parameter searchName", "alias" in the import certificate trusted page | ||
| CVE-2020-2248 | Med | 0.40 | 6.1 | 0.01 | Sep 1, 2020 | Jenkins JSGames Plugin 0.2 and earlier evaluates part of a URL as code, resulting in a reflected cross-site scripting (XSS) vulnerability. | ||
| CVE-2020-20628 | Med | 0.40 | 6.1 | 0.01 | Aug 31, 2020 | controller/controller-comments.php in WP GDPR plugin through 2.1.1 has unauthenticated stored XSS. | ||
| CVE-2020-24699 | Med | 0.40 | 6.1 | 0.01 | Aug 31, 2020 | The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS. | ||
| CVE-2020-17465 | Med | 0.40 | 6.1 | 0.01 | Aug 31, 2020 | Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS. The vulnerability affects versions 6.5.0.4, 6.0.0.6. | ||
| CVE-2020-13655 | Med | 0.40 | 6.1 | 0.01 | Aug 31, 2020 | An issue was discovered in Collabtive 3.0 and later. managefile.php is vulnerable to XSS: when the action parameter is set to movefile and the id parameter corresponds to a project the current user has access to, the file and target parameters are reflected. | ||
| CVE-2020-25033 | Med | 0.40 | 6.1 | 0.01 | Aug 31, 2020 | The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS. | ||
| CVE-2020-24104 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2020 | XSS on the PIX-Link Repeater/Router LV-WR07 with firmware v28K.Router.20170904 allows attackers to steal credentials without being connected to the network. The attack vector is a crafted ESSID, as demonstrated by the wireless.htm SET2 parameter. | ||
| CVE-2020-24917 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2020 | osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php. |
- risk 0.40cvss 6.1epss 0.01
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in blog.php. within application/views/templates/clothesshop, application/views/templates/onepage, and application/views/templates/redlabel.
- risk 0.40cvss 6.1epss 0.01
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in _parts/header.php, within application/views/templates/clothesshop, application/views/templates/greenlabel, and application/views/templates/redlabel.
- risk 0.40cvss 6.1epss 0.01
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/vendor/views/add_product.php.
- risk 0.40cvss 6.1epss 0.01
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/publish.php.
- risk 0.40cvss 6.1epss 0.01
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/discounts.php.
- risk 0.40cvss 6.1epss 0.01
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/blog/blogpublish.php.
- risk 0.40cvss 6.1epss 0.01
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/languages.php.
- risk 0.40cvss 6.1epss 0.01
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/adminUsers.php.
- risk 0.40cvss 6.1epss 0.04
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
- risk 0.40cvss 6.1epss 0.01
A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows remote attackers to inject arbitrary web script or HTML via the GET request "searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin",…
- risk 0.40cvss 6.1epss 0.01
Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin",…
- risk 0.40cvss 6.1epss 0.01
In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnerable POST parameter searchName", "alias" in the import certificate trusted page
- risk 0.40cvss 6.1epss 0.01
Jenkins JSGames Plugin 0.2 and earlier evaluates part of a URL as code, resulting in a reflected cross-site scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
controller/controller-comments.php in WP GDPR plugin through 2.1.1 has unauthenticated stored XSS.
- risk 0.40cvss 6.1epss 0.01
The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.
- risk 0.40cvss 6.1epss 0.01
Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS. The vulnerability affects versions 6.5.0.4, 6.0.0.6.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Collabtive 3.0 and later. managefile.php is vulnerable to XSS: when the action parameter is set to movefile and the id parameter corresponds to a project the current user has access to, the file and target parameters are reflected.
- risk 0.40cvss 6.1epss 0.01
The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS.
- risk 0.40cvss 6.1epss 0.01
XSS on the PIX-Link Repeater/Router LV-WR07 with firmware v28K.Router.20170904 allows attackers to steal credentials without being connected to the network. The attack vector is a crafted ESSID, as demonstrated by the wireless.htm SET2 parameter.
- risk 0.40cvss 6.1epss 0.01
osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php.