CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 915 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-10994 | Med | 0.40 | 6.1 | 0.01 | Sep 18, 2019 | The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter. | ||
| CVE-2019-16392 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages. | ||
| CVE-2019-11559 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | A reflected Cross-site scripting (XSS) vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to the Login component. | ||
| CVE-2016-10992 | Med | 0.40 | 6.1 | 0.02 | Sep 17, 2019 | The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter. | ||
| CVE-2016-10990 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header. | ||
| CVE-2016-10988 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption, facebook_description, default_image, or _wp_http_referer. | ||
| CVE-2016-10987 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS. | ||
| CVE-2016-10986 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret. | ||
| CVE-2016-10985 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter. | ||
| CVE-2016-10984 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter. | ||
| CVE-2016-10981 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text. | ||
| CVE-2016-10980 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento_pvc_geo. | ||
| CVE-2016-10979 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS. | ||
| CVE-2016-10976 | Med | 0.40 | 6.1 | 0.02 | Sep 17, 2019 | The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS. | ||
| CVE-2016-10975 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter. | ||
| CVE-2019-15739 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2019 | An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown were not properly sanitizing some XSS payloads. | ||
| CVE-2019-15724 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2019 | An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.2.1. Label descriptions are vulnerable to HTML injection. | ||
| CVE-2016-10973 | Med | 0.40 | 6.1 | 0.02 | Sep 16, 2019 | The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php. | ||
| CVE-2019-15950 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2019 | The CRM Plugin before 4.2.4 for Redmine allows XSS via crafted vCard data. | ||
| CVE-2016-10967 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2019 | The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter. |
- risk 0.40cvss 6.1epss 0.01
The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter.
- risk 0.40cvss 6.1epss 0.01
SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages.
- risk 0.40cvss 6.1epss 0.01
A reflected Cross-site scripting (XSS) vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to the Login component.
- risk 0.40cvss 6.1epss 0.02
The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.
- risk 0.40cvss 6.1epss 0.01
The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.
- risk 0.40cvss 6.1epss 0.01
The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption, facebook_description, default_image, or _wp_http_referer.
- risk 0.40cvss 6.1epss 0.01
The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS.
- risk 0.40cvss 6.1epss 0.01
The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret.
- risk 0.40cvss 6.1epss 0.01
The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter.
- risk 0.40cvss 6.1epss 0.01
The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.
- risk 0.40cvss 6.1epss 0.01
The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text.
- risk 0.40cvss 6.1epss 0.01
The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento_pvc_geo.
- risk 0.40cvss 6.1epss 0.01
The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.02
The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.
- risk 0.40cvss 6.1epss 0.01
The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown were not properly sanitizing some XSS payloads.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.2.1. Label descriptions are vulnerable to HTML injection.
- risk 0.40cvss 6.1epss 0.02
The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.
- risk 0.40cvss 6.1epss 0.01
The CRM Plugin before 4.2.4 for Redmine allows XSS via crafted vCard data.
- risk 0.40cvss 6.1epss 0.01
The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter.