CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 906 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-18205 | Med | 0.40 | 6.1 | 0.01 | Oct 30, 2019 | Multiple Reflected Cross-site Scripting (XSS) vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1. The browsing component did not properly sanitize user input (encoded in base64). This also applies to the search functionality for the searchKey parameter. | ||
| CVE-2018-18678 | Med | 0.40 | 6.1 | 0.01 | Oct 30, 2019 | GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board group extra contents" parameter, aka the adm/boardgroup_form_update.php gr_1~10 parameter. | ||
| CVE-2019-13066 | Med | 0.40 | 6.1 | 0.01 | Oct 29, 2019 | Sahi Pro 8.0.0 has a script manager arena located at _s_/dyn/pro/DBReports with many different areas that are vulnerable to reflected XSS, by updating a script's Script Name, Suite Name, Base URL, Android, iOS, Scripts Run, Origin Machine, or Comment field. The sql parameter can… | ||
| CVE-2018-10727 | Med | 0.40 | 6.1 | 0.01 | Oct 29, 2019 | Reflected Cross-Site Scripting (XSS) vulnerability in the fabrik_referrer hidden field in the Fabrikar Fabrik component through v3.8.1 for Joomla! allows remote attackers to inject arbitrary web script via the HTTP Referer header. | ||
| CVE-2011-0428 | Med | 0.40 | 6.1 | 0.01 | Oct 29, 2019 | Cross Site Scripting (XSS) in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient checking in comments. | ||
| CVE-2010-4245 | Med | 0.40 | 6.1 | 0.01 | Oct 28, 2019 | pootle 2.0.5 has XSS via 'match_names' parameter | ||
| CVE-2010-4240 | Med | 0.40 | 6.1 | 0.01 | Oct 28, 2019 | Tiki Wiki CMS Groupware 5.2 has XSS | ||
| CVE-2009-4900 | Med | 0.40 | 6.1 | 0.01 | Oct 28, 2019 | pixelpost 1.7.1 has XSS | ||
| CVE-2019-18221 | Med | 0.40 | 6.1 | 0.01 | Oct 25, 2019 | CoreHR Core Portal before 27.0.7 allows stored XSS. | ||
| CVE-2019-8085 | Med | 0.40 | 6.1 | 0.01 | Oct 25, 2019 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | ||
| CVE-2019-8084 | Med | 0.40 | 6.1 | 0.01 | Oct 25, 2019 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | ||
| CVE-2019-8083 | Med | 0.40 | 6.1 | 0.01 | Oct 25, 2019 | Adobe Experience Manager versions 6.5, 6.4 and 6.3 have a cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | ||
| CVE-2019-18419 | Med | 0.40 | 6.1 | 0.01 | Oct 24, 2019 | A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web script or HTML via the lang parameter. | ||
| CVE-2019-8080 | Med | 0.40 | 6.1 | 0.02 | Oct 24, 2019 | Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability. Successful exploitation could lead to privilege escalation. | ||
| CVE-2019-8079 | Med | 0.40 | 6.1 | 0.01 | Oct 24, 2019 | Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | ||
| CVE-2019-8078 | Med | 0.40 | 6.1 | 0.02 | Oct 24, 2019 | Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | ||
| CVE-2019-18416 | Med | 0.40 | 6.1 | 0.01 | Oct 24, 2019 | Sourcecodester Restaurant Management System 1.0 allows XSS via the Last Name field of a member. | ||
| CVE-2019-18415 | Med | 0.40 | 6.1 | 0.01 | Oct 24, 2019 | Sourcecodester Restaurant Management System 1.0 allows XSS via the "send a message" screen. | ||
| CVE-2019-12094 | Med | 0.40 | 6.1 | 0.02 | Oct 24, 2019 | Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=update_f&user_name= or admin/user.php?form=remove_f&user_name= or admin/config/diff.php?app= URI. | ||
| CVE-2019-17581 | Med | 0.40 | 6.1 | 0.01 | Oct 24, 2019 | tonyy dormsystem through 1.3 allows DOM XSS. |
- risk 0.40cvss 6.1epss 0.01
Multiple Reflected Cross-site Scripting (XSS) vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1. The browsing component did not properly sanitize user input (encoded in base64). This also applies to the search functionality for the searchKey parameter.
- risk 0.40cvss 6.1epss 0.01
GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board group extra contents" parameter, aka the adm/boardgroup_form_update.php gr_1~10 parameter.
- risk 0.40cvss 6.1epss 0.01
Sahi Pro 8.0.0 has a script manager arena located at _s_/dyn/pro/DBReports with many different areas that are vulnerable to reflected XSS, by updating a script's Script Name, Suite Name, Base URL, Android, iOS, Scripts Run, Origin Machine, or Comment field. The sql parameter can…
- risk 0.40cvss 6.1epss 0.01
Reflected Cross-Site Scripting (XSS) vulnerability in the fabrik_referrer hidden field in the Fabrikar Fabrik component through v3.8.1 for Joomla! allows remote attackers to inject arbitrary web script via the HTTP Referer header.
- risk 0.40cvss 6.1epss 0.01
Cross Site Scripting (XSS) in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient checking in comments.
- risk 0.40cvss 6.1epss 0.01
pootle 2.0.5 has XSS via 'match_names' parameter
- risk 0.40cvss 6.1epss 0.01
Tiki Wiki CMS Groupware 5.2 has XSS
- risk 0.40cvss 6.1epss 0.01
pixelpost 1.7.1 has XSS
- risk 0.40cvss 6.1epss 0.01
CoreHR Core Portal before 27.0.7 allows stored XSS.
- risk 0.40cvss 6.1epss 0.01
Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
- risk 0.40cvss 6.1epss 0.01
Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
- risk 0.40cvss 6.1epss 0.01
Adobe Experience Manager versions 6.5, 6.4 and 6.3 have a cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
- risk 0.40cvss 6.1epss 0.02
Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability. Successful exploitation could lead to privilege escalation.
- risk 0.40cvss 6.1epss 0.01
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
- risk 0.40cvss 6.1epss 0.02
Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
- risk 0.40cvss 6.1epss 0.01
Sourcecodester Restaurant Management System 1.0 allows XSS via the Last Name field of a member.
- risk 0.40cvss 6.1epss 0.01
Sourcecodester Restaurant Management System 1.0 allows XSS via the "send a message" screen.
- risk 0.40cvss 6.1epss 0.02
Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=update_f&user_name= or admin/user.php?form=remove_f&user_name= or admin/config/diff.php?app= URI.
- risk 0.40cvss 6.1epss 0.01
tonyy dormsystem through 1.3 allows DOM XSS.