CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 911 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-17385 | Med | 0.40 | 6.1 | 0.01 | Oct 9, 2019 | The animate-it plugin before 2.3.5 for WordPress has XSS. | ||
| CVE-2019-17384 | Med | 0.40 | 6.1 | 0.01 | Oct 9, 2019 | The animate-it plugin before 2.3.4 for WordPress has XSS. | ||
| CVE-2019-17380 | Med | 0.40 | 6.1 | 0.01 | Oct 9, 2019 | cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528). | ||
| CVE-2019-17379 | Med | 0.40 | 6.1 | 0.01 | Oct 9, 2019 | cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527). | ||
| CVE-2019-17378 | Med | 0.40 | 6.1 | 0.01 | Oct 9, 2019 | cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526). | ||
| CVE-2019-17377 | Med | 0.40 | 6.1 | 0.01 | Oct 9, 2019 | cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524). | ||
| CVE-2019-17376 | Med | 0.40 | 6.1 | 0.00 | Oct 9, 2019 | cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521). | ||
| CVE-2019-17368 | Med | 0.40 | 6.1 | 0.01 | Oct 9, 2019 | S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter. | ||
| CVE-2019-10215 | Med | 0.40 | 6.1 | 0.02 | Oct 8, 2019 | Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could exploit this via user interaction to execute code in the user's browser. | ||
| CVE-2019-17108 | Med | 0.40 | 6.1 | 0.01 | Oct 8, 2019 | Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user. | ||
| CVE-2019-17233 | Med | 0.40 | 6.1 | 0.02 | Oct 7, 2019 | Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection. | ||
| CVE-2019-17239 | Med | 0.40 | 6.1 | 0.01 | Oct 7, 2019 | includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues. | ||
| CVE-2015-9453 | Med | 0.40 | 6.1 | 0.02 | Oct 7, 2019 | The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist. | ||
| CVE-2019-15750 | Med | 0.40 | 6.1 | 0.01 | Oct 7, 2019 | A Cross-Site Scripting (XSS) vulnerability in the blog function in SITOS six Build v6.2.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter. | ||
| CVE-2018-18379 | Med | 0.40 | 6.1 | 0.01 | Oct 7, 2019 | The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS. | ||
| CVE-2019-17213 | Med | 0.40 | 6.1 | 0.01 | Oct 6, 2019 | The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header. | ||
| CVE-2019-17205 | Med | 0.40 | 6.1 | 0.01 | Oct 5, 2019 | TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed. | ||
| CVE-2019-4564 | Med | 0.40 | 6.1 | 0.01 | Oct 4, 2019 | IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a… | ||
| CVE-2019-16931 | Med | 0.40 | 6.1 | 0.03 | Oct 3, 2019 | A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php… | ||
| CVE-2019-11651 | Med | 0.40 | 6.1 | 0.01 | Oct 2, 2019 | Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0 Patch Update 12, and version 5.0 Patch Update 2. The vulnerability could be exploited to redirect a user to a malicious page or forge certain… |
- risk 0.40cvss 6.1epss 0.01
The animate-it plugin before 2.3.5 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The animate-it plugin before 2.3.4 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528).
- risk 0.40cvss 6.1epss 0.01
cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527).
- risk 0.40cvss 6.1epss 0.01
cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526).
- risk 0.40cvss 6.1epss 0.01
cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524).
- risk 0.40cvss 6.1epss 0.00
cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521).
- risk 0.40cvss 6.1epss 0.01
S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter.
- risk 0.40cvss 6.1epss 0.02
Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could exploit this via user interaction to execute code in the user's browser.
- risk 0.40cvss 6.1epss 0.01
Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user.
- risk 0.40cvss 6.1epss 0.02
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.
- risk 0.40cvss 6.1epss 0.01
includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues.
- risk 0.40cvss 6.1epss 0.02
The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist.
- risk 0.40cvss 6.1epss 0.01
A Cross-Site Scripting (XSS) vulnerability in the blog function in SITOS six Build v6.2.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
- risk 0.40cvss 6.1epss 0.01
The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header.
- risk 0.40cvss 6.1epss 0.01
TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed.
- risk 0.40cvss 6.1epss 0.01
IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
- risk 0.40cvss 6.1epss 0.03
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php…
- risk 0.40cvss 6.1epss 0.01
Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0 Patch Update 12, and version 5.0 Patch Update 2. The vulnerability could be exploited to redirect a user to a malicious page or forge certain…