CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 909 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2015-9500 | Med | 0.40 | 6.1 | 0.01 | Oct 22, 2019 | The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js. | ||
| CVE-2015-9495 | Med | 0.40 | 6.1 | 0.01 | Oct 22, 2019 | The syndication-links plugin before 1.0.3 for WordPress has XSS via the genericons/example.html anchor identifier. | ||
| CVE-2015-9494 | Med | 0.40 | 6.1 | 0.01 | Oct 22, 2019 | The indieweb-post-kinds plugin before 1.3.1.1 for WordPress has XSS via the genericons/example.html anchor identifier. | ||
| CVE-2015-9493 | Med | 0.40 | 6.1 | 0.01 | Oct 22, 2019 | The my-wish-list plugin before 1.4.2 for WordPress has multiple XSS issues. | ||
| CVE-2019-18203 | Med | 0.40 | 6.1 | 0.01 | Oct 21, 2019 | On the RICOH MP 501 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn and KeyDisplay parameter to /web/entry/en/address/adrsSetUserWizard.cgi. | ||
| CVE-2019-8160 | Med | 0.40 | 6.1 | 0.01 | Oct 17, 2019 | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have a cross-site scripting vulnerability. Successful exploitation could lead to information… | ||
| CVE-2019-17116 | Med | 0.40 | 6.1 | 0.02 | Oct 17, 2019 | A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/groups.jsp. The groupName parameter is vulnerable: the reflected cross-site scripting… | ||
| CVE-2019-17115 | Med | 0.40 | 6.1 | 0.02 | Oct 17, 2019 | Multiple cross-site scripting (XSS) vulnerabilities in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML that is triggered when Logs.jsp is visited. The rendered_message column is retrieved and displayed, unsanitized,… | ||
| CVE-2019-17114 | Med | 0.40 | 6.1 | 0.02 | Oct 17, 2019 | A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/userPreregistration.jsp. The preRegistrationData parameter is vulnerable: a reflected… | ||
| CVE-2019-17611 | Med | 0.40 | 6.1 | 0.01 | Oct 16, 2019 | HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter. | ||
| CVE-2019-17610 | Med | 0.40 | 6.1 | 0.01 | Oct 16, 2019 | HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter. | ||
| CVE-2019-17609 | Med | 0.40 | 6.1 | 0.01 | Oct 16, 2019 | HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter. | ||
| CVE-2019-17608 | Med | 0.40 | 6.1 | 0.01 | Oct 16, 2019 | HongCMS 3.0.0 has XSS via the install/index.php dbname parameter. | ||
| CVE-2019-17607 | Med | 0.40 | 6.1 | 0.01 | Oct 16, 2019 | HongCMS 3.0.0 has XSS via the install/index.php servername parameter. | ||
| CVE-2019-12718 | Med | 0.40 | 6.1 | 0.01 | Oct 16, 2019 | A vulnerability in the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient… | ||
| CVE-2019-12705 | Med | 0.40 | 6.1 | 0.01 | Oct 16, 2019 | A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management… | ||
| CVE-2019-17663 | Med | 0.40 | 6.1 | 0.01 | Oct 16, 2019 | D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection. | ||
| CVE-2019-17660 | Med | 0.40 | 6.1 | 0.01 | Oct 16, 2019 | A cross-site scripting (XSS) vulnerability in admin/translate/translateheader_view.php in LimeSurvey 3.19.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the tolang parameter, as demonstrated by the index.php/admin/translate/sa/index/surveyid/3368… | ||
| CVE-2019-16521 | Med | 0.40 | 6.1 | 0.01 | Oct 16, 2019 | The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The filter function on the page listing all detected broken links can be exploited by… | ||
| CVE-2016-11016 | Med | 0.40 | 6.1 | 0.02 | Oct 16, 2019 | NETGEAR JNR1010 devices before 1.0.0.32 allow webproc?getpage= XSS. |
- risk 0.40cvss 6.1epss 0.01
The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js.
- risk 0.40cvss 6.1epss 0.01
The syndication-links plugin before 1.0.3 for WordPress has XSS via the genericons/example.html anchor identifier.
- risk 0.40cvss 6.1epss 0.01
The indieweb-post-kinds plugin before 1.3.1.1 for WordPress has XSS via the genericons/example.html anchor identifier.
- risk 0.40cvss 6.1epss 0.01
The my-wish-list plugin before 1.4.2 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
On the RICOH MP 501 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn and KeyDisplay parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
- risk 0.40cvss 6.1epss 0.01
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have a cross-site scripting vulnerability. Successful exploitation could lead to information…
- risk 0.40cvss 6.1epss 0.02
A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/groups.jsp. The groupName parameter is vulnerable: the reflected cross-site scripting…
- risk 0.40cvss 6.1epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML that is triggered when Logs.jsp is visited. The rendered_message column is retrieved and displayed, unsanitized,…
- risk 0.40cvss 6.1epss 0.02
A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/userPreregistration.jsp. The preRegistrationData parameter is vulnerable: a reflected…
- risk 0.40cvss 6.1epss 0.01
HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter.
- risk 0.40cvss 6.1epss 0.01
HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter.
- risk 0.40cvss 6.1epss 0.01
HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter.
- risk 0.40cvss 6.1epss 0.01
HongCMS 3.0.0 has XSS via the install/index.php dbname parameter.
- risk 0.40cvss 6.1epss 0.01
HongCMS 3.0.0 has XSS via the install/index.php servername parameter.
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management…
- risk 0.40cvss 6.1epss 0.01
D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in admin/translate/translateheader_view.php in LimeSurvey 3.19.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the tolang parameter, as demonstrated by the index.php/admin/translate/sa/index/surveyid/3368…
- risk 0.40cvss 6.1epss 0.01
The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The filter function on the page listing all detected broken links can be exploited by…
- risk 0.40cvss 6.1epss 0.02
NETGEAR JNR1010 devices before 1.0.0.32 allow webproc?getpage= XSS.