CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 895 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-6848 | Med | 0.40 | 6.1 | 0.01 | Jan 13, 2020 | Axper Vision II 4 devices allow XSS via the DEVICE_NAME (aka Device Name) parameter to the configWebParams.cgi URI. | ||
| CVE-2019-20377 | Med | 0.40 | 6.1 | 0.01 | Jan 11, 2020 | TopList before 2019-09-03 allows XSS via a title. | ||
| CVE-2019-20379 | Med | 0.40 | 6.1 | 0.01 | Jan 11, 2020 | ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php cs parameter. | ||
| CVE-2019-20378 | Med | 0.40 | 6.1 | 0.01 | Jan 11, 2020 | ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php ce parameter. | ||
| CVE-2014-4561 | Med | 0.40 | 6.1 | 0.04 | Jan 10, 2020 | The ultimate-weather plugin 1.0 for WordPress has XSS | ||
| CVE-2014-4530 | Med | 0.40 | 6.1 | 0.01 | Jan 10, 2020 | flog plugin 0.1 for WordPress has XSS | ||
| CVE-2020-6758 | Med | 0.40 | 6.1 | 0.01 | Jan 9, 2020 | A cross-site scripting (XSS) vulnerability in Option/optionsAll.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows remote attackers to inject arbitrary web script or HTML via the ContentFrame parameter. | ||
| CVE-2020-5308 | Med | 0.40 | 6.1 | 0.01 | Jan 9, 2020 | PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to XSS, as demonstrated by the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName parameter in add-product.php. | ||
| CVE-2020-6632 | Med | 0.40 | 6.1 | 0.01 | Jan 9, 2020 | In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a QuickAccess link. This is related to AdminQuickAccessesController.php, themes/default/template/header.tpl, and themes/new-theme/js/header.js. | ||
| CVE-2019-17022 | Med | 0.40 | 6.1 | 0.02 | Jan 8, 2020 | When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage;… | ||
| CVE-2019-17016 | Med | 0.40 | 6.1 | 0.02 | Jan 8, 2020 | When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR < 68.4 and… | ||
| CVE-2019-17001 | Med | 0.40 | 6.1 | 0.01 | Jan 8, 2020 | A Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the protected document (cross-site scripting). This is a separate bypass from CVE-2019-17000.*Note: This flaw only affected Firefox 69 and was not present in… | ||
| CVE-2019-17000 | Med | 0.40 | 6.1 | 0.01 | Jan 8, 2020 | An object tag with a data URI did not correctly inherit the document's Content Security Policy. This allowed a CSP bypass in a cross-origin frame if the document's policy explicitly allowed data: URIs. This vulnerability affects Firefox < 70. | ||
| CVE-2020-6583 | Med | 0.40 | 6.1 | 0.01 | Jan 8, 2020 | BigProf Online Invoicing System (OIS) through 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability, retrieve the session cookie from the administrator login, and take over the administrator account via the Name field in an Add… | ||
| CVE-2019-11763 | Med | 0.40 | 6.1 | 0.01 | Jan 8, 2020 | Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have… | ||
| CVE-2019-20365 | Med | 0.40 | 6.1 | 0.01 | Jan 8, 2020 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page. | ||
| CVE-2019-20364 | Med | 0.40 | 6.1 | 0.01 | Jan 8, 2020 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp. | ||
| CVE-2019-20363 | Med | 0.40 | 6.1 | 0.01 | Jan 8, 2020 | An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents. | ||
| CVE-2020-6163 | Med | 0.40 | 6.1 | 0.01 | Jan 8, 2020 | The WikibaseMediaInfo extension 1.35 for MediaWiki allows XSS because of improper template syntax within the PropertySuggestionsWidget template (in the templates/search/PropertySuggestionsWidget.mustache+dom file). | ||
| CVE-2019-18652 | Med | 0.40 | 6.1 | 0.01 | Jan 7, 2020 | A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript in the victim's browser by tricking the victim into clicking on a crafted link. The payload was tested in Microsoft Internet Explorer… |
- risk 0.40cvss 6.1epss 0.01
Axper Vision II 4 devices allow XSS via the DEVICE_NAME (aka Device Name) parameter to the configWebParams.cgi URI.
- risk 0.40cvss 6.1epss 0.01
TopList before 2019-09-03 allows XSS via a title.
- risk 0.40cvss 6.1epss 0.01
ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php cs parameter.
- risk 0.40cvss 6.1epss 0.01
ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php ce parameter.
- risk 0.40cvss 6.1epss 0.04
The ultimate-weather plugin 1.0 for WordPress has XSS
- risk 0.40cvss 6.1epss 0.01
flog plugin 0.1 for WordPress has XSS
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in Option/optionsAll.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows remote attackers to inject arbitrary web script or HTML via the ContentFrame parameter.
- risk 0.40cvss 6.1epss 0.01
PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to XSS, as demonstrated by the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName parameter in add-product.php.
- risk 0.40cvss 6.1epss 0.01
In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a QuickAccess link. This is related to AdminQuickAccessesController.php, themes/default/template/header.tpl, and themes/new-theme/js/header.js.
- risk 0.40cvss 6.1epss 0.02
When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage;…
- risk 0.40cvss 6.1epss 0.02
When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR < 68.4 and…
- risk 0.40cvss 6.1epss 0.01
A Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the protected document (cross-site scripting). This is a separate bypass from CVE-2019-17000.*Note: This flaw only affected Firefox 69 and was not present in…
- risk 0.40cvss 6.1epss 0.01
An object tag with a data URI did not correctly inherit the document's Content Security Policy. This allowed a CSP bypass in a cross-origin frame if the document's policy explicitly allowed data: URIs. This vulnerability affects Firefox < 70.
- risk 0.40cvss 6.1epss 0.01
BigProf Online Invoicing System (OIS) through 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability, retrieve the session cookie from the administrator login, and take over the administrator account via the Name field in an Add…
- risk 0.40cvss 6.1epss 0.01
Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have…
- risk 0.40cvss 6.1epss 0.01
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page.
- risk 0.40cvss 6.1epss 0.01
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp.
- risk 0.40cvss 6.1epss 0.01
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents.
- risk 0.40cvss 6.1epss 0.01
The WikibaseMediaInfo extension 1.35 for MediaWiki allows XSS because of improper template syntax within the PropertySuggestionsWidget template (in the templates/search/PropertySuggestionsWidget.mustache+dom file).
- risk 0.40cvss 6.1epss 0.01
A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript in the victim's browser by tricking the victim into clicking on a crafted link. The payload was tested in Microsoft Internet Explorer…