CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 927 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-14789 | Med | 0.40 | 6.1 | 0.02 | Aug 15, 2019 | The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter. | ||
| CVE-2019-14784 | Med | 0.40 | 6.1 | 0.01 | Aug 15, 2019 | The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition. | ||
| CVE-2019-14790 | Med | 0.40 | 6.1 | 0.01 | Aug 15, 2019 | The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter, | ||
| CVE-2019-14427 | Med | 0.40 | 6.1 | 0.01 | Aug 14, 2019 | XSS exists in WEB STUDIO Ultimate Loan Manager 2.0 by adding a branch under the Branches button that sets the notes parameter with crafted JavaScript code. | ||
| CVE-2018-19386 | Med | 0.40 | 6.1 | 0.09 | Aug 14, 2019 | SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI. | ||
| CVE-2016-10881 | Med | 0.40 | 6.1 | 0.01 | Aug 14, 2019 | The google-document-embedder plugin before 2.6.2 for WordPress has XSS. | ||
| CVE-2016-10880 | Med | 0.40 | 6.1 | 0.01 | Aug 14, 2019 | The google-document-embedder plugin before 2.6.1 for WordPress has XSS. | ||
| CVE-2015-9314 | Med | 0.40 | 6.1 | 0.01 | Aug 14, 2019 | The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header. | ||
| CVE-2015-9312 | Med | 0.40 | 6.1 | 0.02 | Aug 14, 2019 | The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element. | ||
| CVE-2015-9311 | Med | 0.40 | 6.1 | 0.01 | Aug 14, 2019 | The newstatpress plugin before 1.0.6 for WordPress has reflected XSS. | ||
| CVE-2019-0337 | Med | 0.40 | 6.1 | 0.01 | Aug 14, 2019 | Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and allows an attacker to execute malicious scripts in the url thereby resulting in Reflected Cross-Site Scripting (XSS)… | ||
| CVE-2019-0335 | Med | 0.40 | 6.1 | 0.01 | Aug 14, 2019 | Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload within the description field of a user account. The payload is triggered when the mouse cursor is… | ||
| CVE-2019-0332 | Med | 0.40 | 6.1 | 0.01 | Aug 14, 2019 | SAP BusinessObjects Business Intelligence Platform (Info View), versions 4.1, 4.2, 4.3, allows an attacker to give some payload for keyword in the search and it will be executed while search performs its action, resulting in Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2017-18488 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues. | ||
| CVE-2017-18487 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues. | ||
| CVE-2016-10867 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages. | ||
| CVE-2016-10866 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues. | ||
| CVE-2018-20963 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The contact-form-to-email plugin before 1.2.66 for WordPress has XSS. | ||
| CVE-2017-18507 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS. | ||
| CVE-2017-18498 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search. |
- risk 0.40cvss 6.1epss 0.02
The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.
- risk 0.40cvss 6.1epss 0.01
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.
- risk 0.40cvss 6.1epss 0.01
The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,
- risk 0.40cvss 6.1epss 0.01
XSS exists in WEB STUDIO Ultimate Loan Manager 2.0 by adding a branch under the Branches button that sets the notes parameter with crafted JavaScript code.
- risk 0.40cvss 6.1epss 0.09
SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI.
- risk 0.40cvss 6.1epss 0.01
The google-document-embedder plugin before 2.6.2 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The google-document-embedder plugin before 2.6.1 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.
- risk 0.40cvss 6.1epss 0.02
The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.
- risk 0.40cvss 6.1epss 0.01
The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.
- risk 0.40cvss 6.1epss 0.01
Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and allows an attacker to execute malicious scripts in the url thereby resulting in Reflected Cross-Site Scripting (XSS)…
- risk 0.40cvss 6.1epss 0.01
Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload within the description field of a user account. The payload is triggered when the mouse cursor is…
- risk 0.40cvss 6.1epss 0.01
SAP BusinessObjects Business Intelligence Platform (Info View), versions 4.1, 4.2, 4.3, allows an attacker to give some payload for keyword in the search and it will be executed while search performs its action, resulting in Cross-Site Scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.
- risk 0.40cvss 6.1epss 0.01
The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.