CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 898 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-9206 | Med | 0.40 | 6.1 | 0.01 | Dec 31, 2019 | PRTG Network Monitor v7.1.3.3378 allows XSS via the /public/login.htm errormsg or loginurl parameter. NOTE: This product is discontinued. | ||
| CVE-2018-14476 | Med | 0.40 | 6.1 | 0.01 | Dec 31, 2019 | GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation. | ||
| CVE-2018-7859 | Med | 0.40 | 6.1 | 0.01 | Dec 30, 2019 | A security vulnerability in D-Link DGS-1510-series switches with firmware 1.20.011, 1.30.007, 1.31.B003 and older that may allow a remote attacker to inject malicious scripts in the device and execute commands via browser that is configuring the unit. | ||
| CVE-2019-20141 | Med | 0.40 | 6.1 | 0.05 | Dec 30, 2019 | An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter. | ||
| CVE-2019-19738 | Med | 0.40 | 6.1 | 0.01 | Dec 30, 2019 | log_file_viewer.php in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the lFile parameter on the page, which would allow an attacker to input HTML or execute scripts on the site, aka XSS. | ||
| CVE-2019-19733 | Med | 0.40 | 6.1 | 0.01 | Dec 30, 2019 | _get_all_file_server_paths.ajax.php (aka get_all_file_server_paths.ajax.php) in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the fileIds parameter on the page, which would allow an attacker to input HTML or execute scripts on the site, aka… | ||
| CVE-2019-20076 | Med | 0.40 | 6.1 | 0.02 | Dec 30, 2019 | On Netis DL4323 devices, XSS exists via the form2Ddns.cgi username parameter (DynDns settings of the Dynamic DNS Configuration). | ||
| CVE-2019-20075 | Med | 0.40 | 6.1 | 0.02 | Dec 30, 2019 | On Netis DL4323 devices, pingrtt_v6.html has XSS (Ping6 Diagnostic). | ||
| CVE-2019-20073 | Med | 0.40 | 6.1 | 0.02 | Dec 30, 2019 | On Netis DL4323 devices, XSS exists via the form2userconfig.cgi username parameter (User Account Configuration). | ||
| CVE-2019-20072 | Med | 0.40 | 6.1 | 0.02 | Dec 30, 2019 | On Netis DL4323 devices, XSS exists via the form2Ddns.cgi hostname parameter (Dynamic DNS Configuration). | ||
| CVE-2019-20070 | Med | 0.40 | 6.1 | 0.01 | Dec 30, 2019 | On Netis DL4323 devices, XSS exists via the urlFQDN parameter to form2url.cgi (aka the Keyword field of the URL Blocking Configuration). | ||
| CVE-2019-20058 | Med | 0.40 | 6.1 | 0.01 | Dec 29, 2019 | Bolt 3.7.0, if Symfony Web Profiler is used, allows XSS because unsanitized search?search= input is shown on the _profiler page. NOTE: this is disputed because profiling was never intended for use in production. This is related to CVE-2018-12040 | ||
| CVE-2014-4550 | Med | 0.40 | 6.1 | 0.04 | Dec 27, 2019 | Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter. | ||
| CVE-2014-4536 | Med | 0.40 | 6.1 | 0.04 | Dec 27, 2019 | Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) go, (2) contactId, or (3)… | ||
| CVE-2014-4535 | Med | 0.40 | 6.1 | 0.04 | Dec 27, 2019 | Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php. | ||
| CVE-2014-4567 | Med | 0.40 | 6.1 | 0.01 | Dec 27, 2019 | Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downloaded before 20140116 for WordPress allows remote attackers to inject arbitrary web script or HTML via the message parameter. | ||
| CVE-2014-4558 | Med | 0.40 | 6.1 | 0.04 | Dec 27, 2019 | Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter. | ||
| CVE-2014-4548 | Med | 0.40 | 6.1 | 0.01 | Dec 27, 2019 | Cross-site scripting (XSS) vulnerability in tinymce/popup.php in the Ruven Toolkit plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the popup parameter. | ||
| CVE-2014-4544 | Med | 0.40 | 6.1 | 0.04 | Dec 27, 2019 | Cross-site scripting (XSS) vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the Filename parameter to getid3/demos/demo.write.php. | ||
| CVE-2014-4539 | Med | 0.40 | 6.1 | 0.04 | Dec 27, 2019 | Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php. |
- risk 0.40cvss 6.1epss 0.01
PRTG Network Monitor v7.1.3.3378 allows XSS via the /public/login.htm errormsg or loginurl parameter. NOTE: This product is discontinued.
- risk 0.40cvss 6.1epss 0.01
GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation.
- risk 0.40cvss 6.1epss 0.01
A security vulnerability in D-Link DGS-1510-series switches with firmware 1.20.011, 1.30.007, 1.31.B003 and older that may allow a remote attacker to inject malicious scripts in the device and execute commands via browser that is configuring the unit.
- risk 0.40cvss 6.1epss 0.05
An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.
- risk 0.40cvss 6.1epss 0.01
log_file_viewer.php in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the lFile parameter on the page, which would allow an attacker to input HTML or execute scripts on the site, aka XSS.
- risk 0.40cvss 6.1epss 0.01
_get_all_file_server_paths.ajax.php (aka get_all_file_server_paths.ajax.php) in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the fileIds parameter on the page, which would allow an attacker to input HTML or execute scripts on the site, aka…
- risk 0.40cvss 6.1epss 0.02
On Netis DL4323 devices, XSS exists via the form2Ddns.cgi username parameter (DynDns settings of the Dynamic DNS Configuration).
- risk 0.40cvss 6.1epss 0.02
On Netis DL4323 devices, pingrtt_v6.html has XSS (Ping6 Diagnostic).
- risk 0.40cvss 6.1epss 0.02
On Netis DL4323 devices, XSS exists via the form2userconfig.cgi username parameter (User Account Configuration).
- risk 0.40cvss 6.1epss 0.02
On Netis DL4323 devices, XSS exists via the form2Ddns.cgi hostname parameter (Dynamic DNS Configuration).
- risk 0.40cvss 6.1epss 0.01
On Netis DL4323 devices, XSS exists via the urlFQDN parameter to form2url.cgi (aka the Keyword field of the URL Blocking Configuration).
- risk 0.40cvss 6.1epss 0.01
Bolt 3.7.0, if Symfony Web Profiler is used, allows XSS because unsanitized search?search= input is shown on the _profiler page. NOTE: this is disputed because profiling was never intended for use in production. This is related to CVE-2018-12040
- risk 0.40cvss 6.1epss 0.04
Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter.
- risk 0.40cvss 6.1epss 0.04
Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) go, (2) contactId, or (3)…
- risk 0.40cvss 6.1epss 0.04
Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downloaded before 20140116 for WordPress allows remote attackers to inject arbitrary web script or HTML via the message parameter.
- risk 0.40cvss 6.1epss 0.04
Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in tinymce/popup.php in the Ruven Toolkit plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the popup parameter.
- risk 0.40cvss 6.1epss 0.04
Cross-site scripting (XSS) vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the Filename parameter to getid3/demos/demo.write.php.
- risk 0.40cvss 6.1epss 0.04
Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.