CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 920 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2012-6717 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562. | ||
| CVE-2011-5329 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2019 | The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562. | ||
| CVE-2019-15700 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text. | ||
| CVE-2019-13274 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter. | ||
| CVE-2017-18591 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php. | ||
| CVE-2016-10936 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option. | ||
| CVE-2015-9350 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button. | ||
| CVE-2019-15644 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS. | ||
| CVE-2019-15643 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The ultimate-faqs plugin before 1.8.22 for WordPress has XSS. | ||
| CVE-2018-21001 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The anycomment plugin before 0.0.33 for WordPress has XSS. | ||
| CVE-2017-18590 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues. | ||
| CVE-2016-10934 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The check-email plugin before 0.5.2 for WordPress has XSS. | ||
| CVE-2015-9349 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser. | ||
| CVE-2015-9347 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors. | ||
| CVE-2015-9346 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The cp-polls plugin before 1.0.5 for WordPress has XSS. | ||
| CVE-2015-9342 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The wp-rollback plugin before 1.2.3 for WordPress has XSS. | ||
| CVE-2014-10395 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list. | ||
| CVE-2018-18668 | Med | 0.40 | 6.1 | 0.01 | Aug 26, 2019 | GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "homepage title" parameter, aka the adm/config_form_update.php cf_title parameter. | ||
| CVE-2019-15478 | Med | 0.40 | 6.1 | 0.01 | Aug 26, 2019 | Status Board 1.1.81 has reflected XSS via logic.ts. | ||
| CVE-2016-6154 | Med | 0.40 | 6.1 | 0.01 | Aug 23, 2019 | The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect). |
- risk 0.40cvss 6.1epss 0.01
The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562.
- risk 0.40cvss 6.1epss 0.01
The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562.
- risk 0.40cvss 6.1epss 0.01
public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text.
- risk 0.40cvss 6.1epss 0.01
In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter.
- risk 0.40cvss 6.1epss 0.01
The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.
- risk 0.40cvss 6.1epss 0.01
The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.
- risk 0.40cvss 6.1epss 0.01
The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.
- risk 0.40cvss 6.1epss 0.01
The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.
- risk 0.40cvss 6.1epss 0.01
The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The anycomment plugin before 0.0.33 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The check-email plugin before 0.5.2 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.
- risk 0.40cvss 6.1epss 0.01
The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.
- risk 0.40cvss 6.1epss 0.01
The cp-polls plugin before 1.0.5 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-rollback plugin before 1.2.3 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list.
- risk 0.40cvss 6.1epss 0.01
GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "homepage title" parameter, aka the adm/config_form_update.php cf_title parameter.
- risk 0.40cvss 6.1epss 0.01
Status Board 1.1.81 has reflected XSS via logic.ts.
- risk 0.40cvss 6.1epss 0.01
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).