CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 910 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-13392 | Med | 0.40 | 6.1 | 0.04 | Oct 16, 2019 | A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient… | ||
| CVE-2019-14227 | Med | 0.40 | 6.1 | 0.01 | Oct 14, 2019 | OX App Suite 7.10.1 and 7.10.2 allows XSS. | ||
| CVE-2019-16344 | Med | 0.40 | 6.1 | 0.01 | Oct 14, 2019 | A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attacker to inject arbitrary web script or HTML via the username or password parameter. | ||
| CVE-2019-17176 | Med | 0.40 | 6.1 | 0.01 | Oct 11, 2019 | Genesys PureEngage Digital (eServices) 8.1.x allows XSS via HtmlChatPanel.jsp or HtmlChatFrameSet.jsp (ActionColor, ClientNickNameColor, Email, email, or email_address parameter). | ||
| CVE-2010-5340 | Med | 0.40 | 6.1 | 0.01 | Oct 11, 2019 | IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/ with the parameter password is non-persistent in 10.2.0. | ||
| CVE-2010-5339 | Med | 0.40 | 6.1 | 0.01 | Oct 11, 2019 | IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][uid] is non-persistent in 10.1.3 and 10.2.0. | ||
| CVE-2010-5338 | Med | 0.40 | 6.1 | 0.01 | Oct 11, 2019 | IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][action] is non-persistent in 10.1.3 and 10.2.0. | ||
| CVE-2010-5337 | Med | 0.40 | 6.1 | 0.01 | Oct 11, 2019 | IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][controller] is non-persistent in 10.1.3 and 10.2.0. | ||
| CVE-2010-5336 | Med | 0.40 | 6.1 | 0.01 | Oct 11, 2019 | IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: admin/login.html with the parameter username is persistent in 10.2.0. | ||
| CVE-2019-17494 | Med | 0.40 | 6.1 | 0.01 | Oct 10, 2019 | laravel-bjyblog 6.1.1 has XSS via a crafted URL. | ||
| CVE-2019-17493 | Med | 0.40 | 6.1 | 0.01 | Oct 10, 2019 | Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem[sample_input] parameter to web/admin/problem/create or web/polygon/problem/update. | ||
| CVE-2019-17491 | Med | 0.40 | 6.1 | 0.01 | Oct 10, 2019 | Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem[description] parameter to web/admin/problem/create or web/polygon/problem/update. | ||
| CVE-2019-17489 | Med | 0.40 | 6.1 | 0.01 | Oct 10, 2019 | Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem[title] parameter to web/polygon/problem/create or web/polygon/problem/update or web/admin/problem/create. | ||
| CVE-2019-17488 | Med | 0.40 | 6.1 | 0.01 | Oct 10, 2019 | b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header. | ||
| CVE-2015-9478 | Med | 0.40 | 6.1 | 0.01 | Oct 10, 2019 | prettyPhoto before 3.1.6 has js/jquery.prettyPhoto.js XSS. | ||
| CVE-2015-9468 | Med | 0.40 | 6.1 | 0.01 | Oct 10, 2019 | The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action. | ||
| CVE-2015-9459 | Med | 0.40 | 6.1 | 0.01 | Oct 10, 2019 | The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter. | ||
| CVE-2019-17430 | Med | 0.40 | 6.1 | 0.01 | Oct 10, 2019 | EyouCms through 2019-07-11 has XSS related to the login.php web_recordnum parameter. | ||
| CVE-2019-17071 | Med | 0.40 | 6.1 | 0.01 | Oct 10, 2019 | The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS. | ||
| CVE-2019-17070 | Med | 0.40 | 6.1 | 0.01 | Oct 10, 2019 | The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer. |
- risk 0.40cvss 6.1epss 0.04
A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient…
- risk 0.40cvss 6.1epss 0.01
OX App Suite 7.10.1 and 7.10.2 allows XSS.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attacker to inject arbitrary web script or HTML via the username or password parameter.
- risk 0.40cvss 6.1epss 0.01
Genesys PureEngage Digital (eServices) 8.1.x allows XSS via HtmlChatPanel.jsp or HtmlChatFrameSet.jsp (ActionColor, ClientNickNameColor, Email, email, or email_address parameter).
- risk 0.40cvss 6.1epss 0.01
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/ with the parameter password is non-persistent in 10.2.0.
- risk 0.40cvss 6.1epss 0.01
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][uid] is non-persistent in 10.1.3 and 10.2.0.
- risk 0.40cvss 6.1epss 0.01
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][action] is non-persistent in 10.1.3 and 10.2.0.
- risk 0.40cvss 6.1epss 0.01
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][controller] is non-persistent in 10.1.3 and 10.2.0.
- risk 0.40cvss 6.1epss 0.01
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: admin/login.html with the parameter username is persistent in 10.2.0.
- risk 0.40cvss 6.1epss 0.01
laravel-bjyblog 6.1.1 has XSS via a crafted URL.
- risk 0.40cvss 6.1epss 0.01
Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem[sample_input] parameter to web/admin/problem/create or web/polygon/problem/update.
- risk 0.40cvss 6.1epss 0.01
Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem[description] parameter to web/admin/problem/create or web/polygon/problem/update.
- risk 0.40cvss 6.1epss 0.01
Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem[title] parameter to web/polygon/problem/create or web/polygon/problem/update or web/admin/problem/create.
- risk 0.40cvss 6.1epss 0.01
b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header.
- risk 0.40cvss 6.1epss 0.01
prettyPhoto before 3.1.6 has js/jquery.prettyPhoto.js XSS.
- risk 0.40cvss 6.1epss 0.01
The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action.
- risk 0.40cvss 6.1epss 0.01
The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter.
- risk 0.40cvss 6.1epss 0.01
EyouCms through 2019-07-11 has XSS related to the login.php web_recordnum parameter.
- risk 0.40cvss 6.1epss 0.01
The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS.
- risk 0.40cvss 6.1epss 0.01
The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer.