CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 890 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2013-1760 | Med | 0.40 | 6.1 | 0.01 | Feb 11, 2020 | The Bug Genie before 3.2.6 has Multiple XSS and HTML Injection Vulnerabilities | ||
| CVE-2012-4519 | Med | 0.40 | 6.1 | 0.01 | Feb 11, 2020 | Zenphoto before 1.4.3.4 admin-news-articles.php date parameter XSS. | ||
| CVE-2019-19661 | Med | 0.40 | 6.1 | 0.01 | Feb 10, 2020 | A Cookie based reflected XSS exists in the Web File Manager of Rumpus FTP Server 8.2.9.1, related to RumpusLoginUserName and snp. | ||
| CVE-2020-1697 | Med | 0.40 | 6.1 | 0.01 | Feb 10, 2020 | It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly… | ||
| CVE-2012-6666 | Med | 0.40 | 6.1 | 0.01 | Feb 10, 2020 | vBSeo before 3.6.0PL2 allows XSS via the member.php u parameter. | ||
| CVE-2012-4029 | Med | 0.40 | 6.1 | 0.01 | Feb 8, 2020 | Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML via the category_name parameter in an addsentcategory action. | ||
| CVE-2014-9126 | Med | 0.40 | 6.1 | 0.01 | Feb 8, 2020 | Multiple cross-site scripting (XSS) vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YII_CSRF_TOKEN HTTP cookie or the StudentDocument, StudentCategories, StudentPreviousDatas parameters to index.php. | ||
| CVE-2011-1086 | Med | 0.40 | 6.1 | 0.02 | Feb 7, 2020 | Cross-site scripting (XSS) vulnerability in admin/system.html in Openfiler 2.3 allows remote attackers to inject arbitrary web script or HTML via the device parameter. | ||
| CVE-2011-1084 | Med | 0.40 | 6.1 | 0.01 | Feb 7, 2020 | A cross-site scripting (XSS) vulnerability in Smoothwall Express 3. | ||
| CVE-2014-6413 | Med | 0.40 | 6.1 | 0.01 | Feb 7, 2020 | A Cross-site Scripting (XSS) vulnerability exists in WatchGuard XTM 11.8.3 via the poll_name parameter in the firewall/policy script. | ||
| CVE-2020-8788 | Med | 0.40 | 6.1 | 0.01 | Feb 7, 2020 | Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS (and HTML injection) via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public… | ||
| CVE-2013-2008 | Med | 0.40 | 6.1 | 0.02 | Feb 7, 2020 | WordPress Super Cache Plugin 1.3 has XSS. | ||
| CVE-2020-5528 | Med | 0.40 | 6.1 | 0.01 | Feb 6, 2020 | Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4603 and earlier (Movable Type 7), Movable Type 6.5.2 and earlier (Movable Type 6.5), Movable Type Advanced 7 r.4603 and earlier (Movable Type Advanced 7), Movable Type Advanced 6.5.2 and earlier… | ||
| CVE-2011-1150 | Med | 0.40 | 6.1 | 0.01 | Feb 5, 2020 | bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter. | ||
| CVE-2011-1069 | Med | 0.40 | 6.1 | 0.01 | Feb 5, 2020 | PHPShop through 0.8.1 has XSS. | ||
| CVE-2019-20173 | Med | 0.40 | 6.1 | 0.02 | Feb 5, 2020 | The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php. | ||
| CVE-2010-4662 | Med | 0.40 | 6.1 | 0.01 | Feb 5, 2020 | PmWiki before 2.2.21 has XSS. | ||
| CVE-2020-7973 | Med | 0.40 | 6.1 | 0.01 | Feb 5, 2020 | GitLab through 12.7.2 allows XSS. | ||
| CVE-2020-7971 | Med | 0.40 | 6.1 | 0.01 | Feb 5, 2020 | GitLab EE 11.0 and later through 12.7.2 allows XSS. | ||
| CVE-2020-8120 | Med | 0.40 | 6.1 | 0.01 | Feb 4, 2020 | A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation. |
- risk 0.40cvss 6.1epss 0.01
The Bug Genie before 3.2.6 has Multiple XSS and HTML Injection Vulnerabilities
- risk 0.40cvss 6.1epss 0.01
Zenphoto before 1.4.3.4 admin-news-articles.php date parameter XSS.
- risk 0.40cvss 6.1epss 0.01
A Cookie based reflected XSS exists in the Web File Manager of Rumpus FTP Server 8.2.9.1, related to RumpusLoginUserName and snp.
- risk 0.40cvss 6.1epss 0.01
It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly…
- risk 0.40cvss 6.1epss 0.01
vBSeo before 3.6.0PL2 allows XSS via the member.php u parameter.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML via the category_name parameter in an addsentcategory action.
- risk 0.40cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YII_CSRF_TOKEN HTTP cookie or the StudentDocument, StudentCategories, StudentPreviousDatas parameters to index.php.
- risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in admin/system.html in Openfiler 2.3 allows remote attackers to inject arbitrary web script or HTML via the device parameter.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in Smoothwall Express 3.
- risk 0.40cvss 6.1epss 0.01
A Cross-site Scripting (XSS) vulnerability exists in WatchGuard XTM 11.8.3 via the poll_name parameter in the firewall/policy script.
- risk 0.40cvss 6.1epss 0.01
Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS (and HTML injection) via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public…
- risk 0.40cvss 6.1epss 0.02
WordPress Super Cache Plugin 1.3 has XSS.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4603 and earlier (Movable Type 7), Movable Type 6.5.2 and earlier (Movable Type 6.5), Movable Type Advanced 7 r.4603 and earlier (Movable Type Advanced 7), Movable Type Advanced 6.5.2 and earlier…
- risk 0.40cvss 6.1epss 0.01
bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter.
- risk 0.40cvss 6.1epss 0.01
PHPShop through 0.8.1 has XSS.
- risk 0.40cvss 6.1epss 0.02
The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.
- risk 0.40cvss 6.1epss 0.01
PmWiki before 2.2.21 has XSS.
- risk 0.40cvss 6.1epss 0.01
GitLab through 12.7.2 allows XSS.
- risk 0.40cvss 6.1epss 0.01
GitLab EE 11.0 and later through 12.7.2 allows XSS.
- risk 0.40cvss 6.1epss 0.01
A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation.