CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 896 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-5842 | Med | 0.40 | 6.1 | 0.02 | Jan 7, 2020 | Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI. The payload is, for example, executed on the admin/index.php?page=users/manage page. | ||
| CVE-2019-16154 | Med | 0.40 | 6.1 | 0.01 | Jan 7, 2020 | An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6.0.0 may allow an unauthenticated user to perform a cross-site scripting attack (XSS) via a parameter of the logon page. | ||
| CVE-2013-5658 | Med | 0.40 | 6.1 | 0.01 | Jan 7, 2020 | AultWare pwStore 2010.8.30.0 has XSS | ||
| CVE-2020-5393 | Med | 0.40 | 6.1 | 0.01 | Jan 7, 2020 | In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS. | ||
| CVE-2019-18842 | Med | 0.40 | 6.1 | 0.01 | Jan 6, 2020 | A cross-site scripting (XSS) vulnerability in the configuration web interface of the Jinan USR IOT USR-WIFI232-S/T/G2/H Low Power WiFi Module with web version 1.2.2 allows attackers to leak credentials of the Wi-Fi access point the module is logged into, and the web interface… | ||
| CVE-2019-16717 | Med | 0.40 | 6.1 | 0.02 | Jan 6, 2020 | OX App Suite through 7.10.2 has XSS. | ||
| CVE-2014-3743 | Med | 0.40 | 6.1 | 0.02 | Jan 6, 2020 | Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's. | ||
| CVE-2019-15603 | Med | 0.40 | 6.1 | 0.01 | Jan 6, 2020 | The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a directory listing. | ||
| CVE-2019-15602 | Med | 0.40 | 6.1 | 0.01 | Jan 6, 2020 | The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability in files it serves. | ||
| CVE-2019-5989 | Med | 0.40 | 6.1 | 0.01 | Jan 6, 2020 | DOM-based cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to inject arbitrary web script or HTML via the Analysis Object Page. | ||
| CVE-2019-5988 | Med | 0.40 | 6.1 | 0.01 | Jan 6, 2020 | Stored cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to inject arbitrary web script or HTML via the Management Page. | ||
| CVE-2019-19265 | Med | 0.40 | 6.1 | 0.01 | Jan 6, 2020 | IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts. | ||
| CVE-2019-20154 | Med | 0.40 | 6.1 | 0.01 | Jan 5, 2020 | An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) v5.4. A cross-site scripting (XSS) vulnerability in multiple getchart.jsp parameters allows remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2019-20336 | Med | 0.40 | 6.1 | 0.01 | Jan 5, 2020 | In PHP Scripts Mall advanced-real-estate-script 4.0.9, the search-results.php searchtext parameter is vulnerable to XSS. | ||
| CVE-2020-5497 | Med | 0.40 | 6.1 | 0.02 | Jan 4, 2020 | The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript. | ||
| CVE-2019-9542 | Med | 0.40 | 6.1 | 0.01 | Jan 3, 2020 | : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in itemlookup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message… | ||
| CVE-2019-9541 | Med | 0.40 | 6.1 | 0.01 | Jan 3, 2020 | : Information Exposure vulnerability in itemlookup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5. | ||
| CVE-2019-9540 | Med | 0.40 | 6.1 | 0.01 | Jan 3, 2020 | : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prefs.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message… | ||
| CVE-2019-9539 | Med | 0.40 | 6.1 | 0.01 | Jan 3, 2020 | : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ModalWindowPopup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated… | ||
| CVE-2019-9538 | Med | 0.40 | 6.1 | 0.01 | Jan 3, 2020 | : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the LDAP cbURL parameter of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos… |
- risk 0.40cvss 6.1epss 0.02
Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI. The payload is, for example, executed on the admin/index.php?page=users/manage page.
- risk 0.40cvss 6.1epss 0.01
An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6.0.0 may allow an unauthenticated user to perform a cross-site scripting attack (XSS) via a parameter of the logon page.
- risk 0.40cvss 6.1epss 0.01
AultWare pwStore 2010.8.30.0 has XSS
- risk 0.40cvss 6.1epss 0.01
In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in the configuration web interface of the Jinan USR IOT USR-WIFI232-S/T/G2/H Low Power WiFi Module with web version 1.2.2 allows attackers to leak credentials of the Wi-Fi access point the module is logged into, and the web interface…
- risk 0.40cvss 6.1epss 0.02
OX App Suite through 7.10.2 has XSS.
- risk 0.40cvss 6.1epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's.
- risk 0.40cvss 6.1epss 0.01
The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a directory listing.
- risk 0.40cvss 6.1epss 0.01
The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability in files it serves.
- risk 0.40cvss 6.1epss 0.01
DOM-based cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to inject arbitrary web script or HTML via the Analysis Object Page.
- risk 0.40cvss 6.1epss 0.01
Stored cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to inject arbitrary web script or HTML via the Management Page.
- risk 0.40cvss 6.1epss 0.01
IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) v5.4. A cross-site scripting (XSS) vulnerability in multiple getchart.jsp parameters allows remote attackers to inject arbitrary web script or HTML.
- risk 0.40cvss 6.1epss 0.01
In PHP Scripts Mall advanced-real-estate-script 4.0.9, the search-results.php searchtext parameter is vulnerable to XSS.
- risk 0.40cvss 6.1epss 0.02
The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript.
- risk 0.40cvss 6.1epss 0.01
: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in itemlookup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message…
- risk 0.40cvss 6.1epss 0.01
: Information Exposure vulnerability in itemlookup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.
- risk 0.40cvss 6.1epss 0.01
: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prefs.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message…
- risk 0.40cvss 6.1epss 0.01
: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ModalWindowPopup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated…
- risk 0.40cvss 6.1epss 0.01
: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the LDAP cbURL parameter of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos…