CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 925 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-18536 | Med | 0.40 | 6.1 | 0.02 | Aug 21, 2019 | The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS. | ||
| CVE-2017-18534 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters. | ||
| CVE-2016-10898 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The total-security plugin before 3.4.1 for WordPress has XSS. | ||
| CVE-2016-10897 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues. | ||
| CVE-2016-10896 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The seo-redirection plugin before 4.3 for WordPress has stored XSS. | ||
| CVE-2015-9321 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg. | ||
| CVE-2019-3966 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. | ||
| CVE-2019-3965 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. | ||
| CVE-2018-20978 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The wp-all-import plugin before 3.4.7 for WordPress has XSS. | ||
| CVE-2017-18566 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The user-role plugin before 1.5.6 for WordPress has multiple XSS issues. | ||
| CVE-2017-18533 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The rimons-twitter-widget plugin before 1.3 for WordPress has XSS. | ||
| CVE-2017-18532 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The realty plugin before 1.1.0 for WordPress has multiple XSS issues. | ||
| CVE-2017-18530 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The rating-bws plugin before 0.2 for WordPress has multiple XSS issues. | ||
| CVE-2017-18529 | Med | 0.40 | 6.1 | 0.02 | Aug 20, 2019 | The promobar plugin before 1.1.1 for WordPress has multiple XSS issues. | ||
| CVE-2017-18528 | Med | 0.40 | 6.1 | 0.02 | Aug 20, 2019 | The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues. | ||
| CVE-2017-18527 | Med | 0.40 | 6.1 | 0.02 | Aug 20, 2019 | The pagination plugin before 1.0.7 for WordPress has multiple XSS issues. | ||
| CVE-2017-18526 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The moreads-se plugin before 1.4.7 for WordPress has XSS. | ||
| CVE-2017-18524 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues. | ||
| CVE-2017-18522 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book. | ||
| CVE-2017-18519 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages. |
- risk 0.40cvss 6.1epss 0.02
The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.
- risk 0.40cvss 6.1epss 0.01
The total-security plugin before 3.4.1 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The seo-redirection plugin before 4.3 for WordPress has stored XSS.
- risk 0.40cvss 6.1epss 0.01
The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.
- risk 0.40cvss 6.1epss 0.01
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
- risk 0.40cvss 6.1epss 0.01
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
- risk 0.40cvss 6.1epss 0.01
The wp-all-import plugin before 3.4.7 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The rimons-twitter-widget plugin before 1.3 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The realty plugin before 1.1.0 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.02
The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.02
The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.02
The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The moreads-se plugin before 1.4.7 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.
- risk 0.40cvss 6.1epss 0.01
The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.