CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 914 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-16657 | Med | 0.40 | 6.1 | 0.01 | Sep 21, 2019 | TuziCMS 2.0.6 has XSS via the PATH_INFO to a group URI, as demonstrated by index.php/article/group/id/2/. | ||
| CVE-2018-11200 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field. | ||
| CVE-2019-16534 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | On DrayTek Vigor2925 devices with firmware 3.8.4.3, XSS exists via a crafted WAN name on the General Setup screen. NOTE: this is an end-of-life product. | ||
| CVE-2019-16533 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | On DrayTek Vigor2925 devices with firmware 3.8.4.3, Incorrect Access Control exists in loginset.htm, and can be used to trigger XSS. NOTE: this is an end-of-life product. | ||
| CVE-2015-9407 | Med | 0.40 | 6.1 | 0.02 | Sep 20, 2019 | The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS. | ||
| CVE-2015-9404 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS. | ||
| CVE-2015-9403 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS. | ||
| CVE-2015-9396 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS. | ||
| CVE-2016-11005 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS. | ||
| CVE-2016-11001 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field. | ||
| CVE-2016-10999 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter. | ||
| CVE-2016-10998 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS. | ||
| CVE-2015-9391 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter. | ||
| CVE-2015-9386 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation. | ||
| CVE-2015-9385 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The quotes-and-tips plugin before 1.20 for WordPress has XSS. | ||
| CVE-2015-9384 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | The relevant plugin before 1.0.8 for WordPress has XSS. | ||
| CVE-2019-15086 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | An issue was discovered in PRiSE adAS 1.7.0. The newentityID parameter is not properly escaped, leading to a reflected XSS in the error message. | ||
| CVE-2019-14915 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | An issue was discovered in PRiSE adAS 1.7.0. Certificate data are not properly escaped. This leads to XSS when submitting a rogue certificate. | ||
| CVE-2019-14911 | Med | 0.40 | 6.1 | 0.01 | Sep 20, 2019 | An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly escape output on error, leading to reflected XSS. | ||
| CVE-2019-16525 | Med | 0.40 | 6.1 | 0.06 | Sep 19, 2019 | An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file, and it is possible to inject JavaScript code. |
- risk 0.40cvss 6.1epss 0.01
TuziCMS 2.0.6 has XSS via the PATH_INFO to a group URI, as demonstrated by index.php/article/group/id/2/.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field.
- risk 0.40cvss 6.1epss 0.01
On DrayTek Vigor2925 devices with firmware 3.8.4.3, XSS exists via a crafted WAN name on the General Setup screen. NOTE: this is an end-of-life product.
- risk 0.40cvss 6.1epss 0.01
On DrayTek Vigor2925 devices with firmware 3.8.4.3, Incorrect Access Control exists in loginset.htm, and can be used to trigger XSS. NOTE: this is an end-of-life product.
- risk 0.40cvss 6.1epss 0.02
The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS.
- risk 0.40cvss 6.1epss 0.01
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS.
- risk 0.40cvss 6.1epss 0.01
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS.
- risk 0.40cvss 6.1epss 0.01
The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS.
- risk 0.40cvss 6.1epss 0.01
The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS.
- risk 0.40cvss 6.1epss 0.01
The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field.
- risk 0.40cvss 6.1epss 0.01
The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter.
- risk 0.40cvss 6.1epss 0.01
The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS.
- risk 0.40cvss 6.1epss 0.01
The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter.
- risk 0.40cvss 6.1epss 0.01
The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.
- risk 0.40cvss 6.1epss 0.01
The quotes-and-tips plugin before 1.20 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The relevant plugin before 1.0.8 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in PRiSE adAS 1.7.0. The newentityID parameter is not properly escaped, leading to a reflected XSS in the error message.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in PRiSE adAS 1.7.0. Certificate data are not properly escaped. This leads to XSS when submitting a rogue certificate.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly escape output on error, leading to reflected XSS.
- risk 0.40cvss 6.1epss 0.06
An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file, and it is possible to inject JavaScript code.