CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 870 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-19880 | Med | 0.40 | 6.1 | 0.01 | Aug 24, 2020 | DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function form 'Name' in dbhcms\types.php, A remote unauthenticated attacker can exploit this vulnerability to hijack other users. | ||
| CVE-2020-19879 | Med | 0.40 | 6.1 | 0.01 | Aug 24, 2020 | DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter of $_GET['dbhcms_pid'] variable in dbhcms\page.php line 107, | ||
| CVE-2020-12759 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2020 | Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook. | ||
| CVE-2019-20152 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2020 | An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input, malicious JavaScript can be executed throughout the application. A malicious payload can be injected within the Custom Workflow component and inserted via the… | ||
| CVE-2019-20151 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2020 | An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input, malicious JavaScript can be executed by the application's administrator(s). A malicious payload can be injected within the Multi Approval security component and… | ||
| CVE-2020-13825 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2020 | A cross-site scripting (XSS) vulnerability in i-doit 1.14.2 allows remote attackers to inject arbitrary web script or HTML via the viewMode, tvMode, tvType, objID, catgID, objTypeID, or editMode parameter. | ||
| CVE-2020-15926 | Med | 0.40 | 6.1 | 0.03 | Aug 18, 2020 | Rocket.Chat through 3.4.2 allows XSS where an attacker can send a specially crafted message to a channel or in a direct message to the client which results in remote code execution on the client side. | ||
| CVE-2020-13183 | Med | 0.40 | 6.1 | 0.01 | Aug 17, 2020 | Reflected Cross Site Scripting in Teradici PCoIP Management Console prior to 20.07 could allow an attacker to take over the user's active session if the user is exposed to a malicious payload. | ||
| CVE-2020-3463 | Med | 0.40 | 6.1 | 0.01 | Aug 17, 2020 | A vulnerability in the web-based management interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected service. The vulnerability is due to… | ||
| CVE-2020-3346 | Med | 0.40 | 6.1 | 0.01 | Aug 17, 2020 | A vulnerability in the web UI of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user… | ||
| CVE-2020-8208 | Med | 0.40 | 6.1 | 0.01 | Aug 17, 2020 | Improper input validation in Citrix XenMobile Server 10.12 before RP1, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.11 before RP6 and Citrix XenMobile Server before 10.9 RP5 allows Cross-Site Scripting (XSS). | ||
| CVE-2019-7410 | Med | 0.40 | 6.1 | 0.01 | Aug 14, 2020 | There is stored cross site scripting (XSS) in Galileo CMS v0.042. Remote authenticated users could inject arbitrary web script or HTML via $page_title in /lib/Galileo/files/templates/page/show.html.ep (aka the PAGE TITLE Field). | ||
| CVE-2019-6112 | Med | 0.40 | 6.1 | 0.09 | Aug 14, 2020 | A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search field). | ||
| CVE-2020-17450 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2020 | PHP-Fusion 9.03 allows XSS on the preview page. | ||
| CVE-2020-17362 | Med | 0.40 | 6.1 | 0.03 | Aug 12, 2020 | search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS. | ||
| CVE-2020-13278 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2020 | Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to execute arbitrary web script via embedding javascript or HTML tags in a GET request. | ||
| CVE-2020-16145 | Med | 0.40 | 6.1 | 0.02 | Aug 12, 2020 | Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15. | ||
| CVE-2020-15071 | Med | 0.40 | 6.1 | 0.01 | Aug 11, 2020 | content/content.blueprintsevents.php in Symphony CMS 3.0.0 allows XSS via fields['name'] to appendSubheading. | ||
| CVE-2020-13176 | Med | 0.40 | 6.1 | 0.01 | Aug 11, 2020 | The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 24, 2020 (v16 and earlier for the Cloud Access Connector) contains a stored cross-site scripting (XSS) vulnerability which allows a remote… | ||
| CVE-2020-16278 | Med | 0.40 | 6.1 | 0.01 | Aug 10, 2020 | A cross-site scripting (XSS) vulnerability in the Permissions component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link. |
- risk 0.40cvss 6.1epss 0.01
DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function form 'Name' in dbhcms\types.php, A remote unauthenticated attacker can exploit this vulnerability to hijack other users.
- risk 0.40cvss 6.1epss 0.01
DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter of $_GET['dbhcms_pid'] variable in dbhcms\page.php line 107,
- risk 0.40cvss 6.1epss 0.01
Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook.
- risk 0.40cvss 6.1epss 0.01
An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input, malicious JavaScript can be executed throughout the application. A malicious payload can be injected within the Custom Workflow component and inserted via the…
- risk 0.40cvss 6.1epss 0.01
An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input, malicious JavaScript can be executed by the application's administrator(s). A malicious payload can be injected within the Multi Approval security component and…
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in i-doit 1.14.2 allows remote attackers to inject arbitrary web script or HTML via the viewMode, tvMode, tvType, objID, catgID, objTypeID, or editMode parameter.
- risk 0.40cvss 6.1epss 0.03
Rocket.Chat through 3.4.2 allows XSS where an attacker can send a specially crafted message to a channel or in a direct message to the client which results in remote code execution on the client side.
- risk 0.40cvss 6.1epss 0.01
Reflected Cross Site Scripting in Teradici PCoIP Management Console prior to 20.07 could allow an attacker to take over the user's active session if the user is exposed to a malicious payload.
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected service. The vulnerability is due to…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web UI of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user…
- risk 0.40cvss 6.1epss 0.01
Improper input validation in Citrix XenMobile Server 10.12 before RP1, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.11 before RP6 and Citrix XenMobile Server before 10.9 RP5 allows Cross-Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.01
There is stored cross site scripting (XSS) in Galileo CMS v0.042. Remote authenticated users could inject arbitrary web script or HTML via $page_title in /lib/Galileo/files/templates/page/show.html.ep (aka the PAGE TITLE Field).
- risk 0.40cvss 6.1epss 0.09
A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search field).
- risk 0.40cvss 6.1epss 0.01
PHP-Fusion 9.03 allows XSS on the preview page.
- risk 0.40cvss 6.1epss 0.03
search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS.
- risk 0.40cvss 6.1epss 0.01
Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to execute arbitrary web script via embedding javascript or HTML tags in a GET request.
- risk 0.40cvss 6.1epss 0.02
Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15.
- risk 0.40cvss 6.1epss 0.01
content/content.blueprintsevents.php in Symphony CMS 3.0.0 allows XSS via fields['name'] to appendSubheading.
- risk 0.40cvss 6.1epss 0.01
The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 24, 2020 (v16 and earlier for the Cloud Access Connector) contains a stored cross-site scripting (XSS) vulnerability which allows a remote…
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in the Permissions component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link.