CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 913 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-11741 | Med | 0.40 | 6.1 | 0.01 | Sep 27, 2019 | A compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS) attack on content from any site it can cause to be loaded in the same process. Because addons.mozilla.org and accounts.firefox.com have close ties to the Firefox product, malicious… | ||
| CVE-2019-16923 | Med | 0.40 | 6.1 | 0.01 | Sep 27, 2019 | kkcms 1.3 has jx.php?url= XSS. | ||
| CVE-2015-9444 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2019 | The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF. | ||
| CVE-2015-9430 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2019 | The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header. | ||
| CVE-2015-9420 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2019 | The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter. | ||
| CVE-2015-9419 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2019 | The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section. | ||
| CVE-2015-9416 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2019 | The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header. | ||
| CVE-2015-9414 | Med | 0.40 | 6.1 | 0.04 | Sep 26, 2019 | The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter. | ||
| CVE-2015-9412 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2019 | The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter. | ||
| CVE-2015-9411 | Med | 0.40 | 6.1 | 0.01 | Sep 26, 2019 | The Postmatic plugin before 1.4.6 for WordPress has XSS. | ||
| CVE-2019-16725 | Med | 0.40 | 6.1 | 0.01 | Sep 24, 2019 | In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates. | ||
| CVE-2019-16751 | Med | 0.40 | 6.1 | 0.01 | Sep 24, 2019 | An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting (XSS) through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's… | ||
| CVE-2018-9090 | Med | 0.40 | 6.1 | 0.01 | Sep 24, 2019 | CoreOS Tectonic 1.7.x and 1.8.x before 1.8.7-tectonic.2 deploys the Grafana web application using default credentials (admin/admin) for the administrator account located at grafana-credentials secret. This occurs because CoreOS does not randomize the administrative password to… | ||
| CVE-2019-12407 | Med | 0.40 | 6.1 | 0.03 | Sep 23, 2019 | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the victim's browser and… | ||
| CVE-2019-10090 | Med | 0.40 | 6.1 | 0.03 | Sep 23, 2019 | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive… | ||
| CVE-2019-12404 | Med | 0.40 | 6.1 | 0.03 | Sep 23, 2019 | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to InfoContent.jsp, which could allow the attacker to execute javascript in the victim's browser and get some sensitive… | ||
| CVE-2019-10089 | Med | 0.40 | 6.1 | 0.03 | Sep 23, 2019 | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSIWYG editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive… | ||
| CVE-2019-10087 | Med | 0.40 | 6.1 | 0.03 | Sep 23, 2019 | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute javascript in the victim's browser and get some sensitive… | ||
| CVE-2019-16703 | Med | 0.40 | 6.1 | 0.01 | Sep 23, 2019 | admin/infolist_add.php in PHPMyWind 5.6 has stored XSS. | ||
| CVE-2019-16665 | Med | 0.40 | 6.1 | 0.01 | Sep 21, 2019 | An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element. |
- risk 0.40cvss 6.1epss 0.01
A compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS) attack on content from any site it can cause to be loaded in the same process. Because addons.mozilla.org and accounts.firefox.com have close ties to the Firefox product, malicious…
- risk 0.40cvss 6.1epss 0.01
kkcms 1.3 has jx.php?url= XSS.
- risk 0.40cvss 6.1epss 0.01
The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF.
- risk 0.40cvss 6.1epss 0.01
The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header.
- risk 0.40cvss 6.1epss 0.01
The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter.
- risk 0.40cvss 6.1epss 0.01
The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section.
- risk 0.40cvss 6.1epss 0.01
The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header.
- risk 0.40cvss 6.1epss 0.04
The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter.
- risk 0.40cvss 6.1epss 0.01
The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter.
- risk 0.40cvss 6.1epss 0.01
The Postmatic plugin before 1.4.6 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting (XSS) through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's…
- risk 0.40cvss 6.1epss 0.01
CoreOS Tectonic 1.7.x and 1.8.x before 1.8.7-tectonic.2 deploys the Grafana web application using default credentials (admin/admin) for the administrator account located at grafana-credentials secret. This occurs because CoreOS does not randomize the administrative password to…
- risk 0.40cvss 6.1epss 0.03
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the victim's browser and…
- risk 0.40cvss 6.1epss 0.03
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive…
- risk 0.40cvss 6.1epss 0.03
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to InfoContent.jsp, which could allow the attacker to execute javascript in the victim's browser and get some sensitive…
- risk 0.40cvss 6.1epss 0.03
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSIWYG editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive…
- risk 0.40cvss 6.1epss 0.03
On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute javascript in the victim's browser and get some sensitive…
- risk 0.40cvss 6.1epss 0.01
admin/infolist_add.php in PHPMyWind 5.6 has stored XSS.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element.