CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 916 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-10964 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2019 | The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header. | ||
| CVE-2016-10963 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2019 | The icegram plugin before 1.9.19 for WordPress has XSS. | ||
| CVE-2016-10961 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2019 | The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter. | ||
| CVE-2016-10957 | Med | 0.40 | 6.1 | 0.01 | Sep 16, 2019 | The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter. | ||
| CVE-2019-16332 | Med | 0.40 | 6.1 | 0.06 | Sep 15, 2019 | In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS. | ||
| CVE-2019-16321 | Med | 0.40 | 6.1 | 0.01 | Sep 15, 2019 | ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATH_INFO. | ||
| CVE-2019-16307 | Med | 0.40 | 6.1 | 0.01 | Sep 14, 2019 | A Reflected Cross-Site Scripting (XSS) vulnerability in the webEx module in webExMeetingLogin.jsp and deleteWebExMeetingCheck.jsp in Fuji Xerox DocuShare through 7.0.0.C1.609 allows remote attackers to inject arbitrary web script or HTML via the handle parameter… | ||
| CVE-2019-16312 | Med | 0.40 | 6.1 | 0.01 | Sep 14, 2019 | s-cms V3.0 has XSS in index.php?type=text via the S_id parameter. | ||
| CVE-2019-12517 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2019 | An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database and later… | ||
| CVE-2016-10952 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2019 | The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter. | ||
| CVE-2017-18615 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2019 | The kama-clic-counter plugin before 3.5.0 for WordPress has XSS. | ||
| CVE-2017-18613 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2019 | The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter. | ||
| CVE-2017-18612 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2019 | The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter. | ||
| CVE-2019-6003 | Med | 0.40 | 6.1 | 0.01 | Sep 12, 2019 | Cross-site scripting vulnerability in EC-CUBE plugin 'Amazon Pay Plugin 2.12,2.13' version 2.4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2019-5985 | Med | 0.40 | 6.1 | 0.01 | Sep 12, 2019 | Cross-site scripting vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and earlier, PR-S300HI/RT-S300HI/RV-S340HI firmware… | ||
| CVE-2019-16238 | Med | 0.40 | 6.1 | 0.01 | Sep 12, 2019 | Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login. | ||
| CVE-2019-1266 | Med | 0.40 | 6.1 | 0.02 | Sep 11, 2019 | A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. | ||
| CVE-2019-10073 | Med | 0.40 | 6.1 | 0.05 | Sep 11, 2019 | The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16.11: 1858438, 1858543, 1860595 and 1860616 | ||
| CVE-2019-14996 | Med | 0.40 | 6.1 | 0.01 | Sep 11, 2019 | The FilterPickerPopup.jspa resource in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter. | ||
| CVE-2019-11464 | Med | 0.40 | 6.1 | 0.01 | Sep 10, 2019 | Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options are generally advisable, however some information security professionals additionally look for… |
- risk 0.40cvss 6.1epss 0.01
The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header.
- risk 0.40cvss 6.1epss 0.01
The icegram plugin before 1.9.19 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter.
- risk 0.40cvss 6.1epss 0.01
The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter.
- risk 0.40cvss 6.1epss 0.06
In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.
- risk 0.40cvss 6.1epss 0.01
ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATH_INFO.
- risk 0.40cvss 6.1epss 0.01
A Reflected Cross-Site Scripting (XSS) vulnerability in the webEx module in webExMeetingLogin.jsp and deleteWebExMeetingCheck.jsp in Fuji Xerox DocuShare through 7.0.0.C1.609 allows remote attackers to inject arbitrary web script or HTML via the handle parameter…
- risk 0.40cvss 6.1epss 0.01
s-cms V3.0 has XSS in index.php?type=text via the S_id parameter.
- risk 0.40cvss 6.1epss 0.01
An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database and later…
- risk 0.40cvss 6.1epss 0.01
The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter.
- risk 0.40cvss 6.1epss 0.01
The kama-clic-counter plugin before 3.5.0 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter.
- risk 0.40cvss 6.1epss 0.01
The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in EC-CUBE plugin 'Amazon Pay Plugin 2.12,2.13' version 2.4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware version Ver. 19.41 and earlier, PR-S300HI/RT-S300HI/RV-S340HI firmware…
- risk 0.40cvss 6.1epss 0.01
Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login.
- risk 0.40cvss 6.1epss 0.02
A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'.
- risk 0.40cvss 6.1epss 0.05
The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16.11: 1858438, 1858543, 1860595 and 1860616
- risk 0.40cvss 6.1epss 0.01
The FilterPickerPopup.jspa resource in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.
- risk 0.40cvss 6.1epss 0.01
Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options are generally advisable, however some information security professionals additionally look for…