CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 930 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-10875 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-database-backup plugin before 4.3.1 for WordPress has XSS. | ||
| CVE-2016-10873 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-database-backup plugin before 4.3.3 for WordPress has XSS. | ||
| CVE-2015-9306 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS. | ||
| CVE-2015-9305 | Med | 0.40 | 6.1 | 0.01 | Aug 12, 2019 | The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions. | ||
| CVE-2019-14807 | Med | 0.40 | 6.1 | 0.01 | Aug 9, 2019 | In the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit summary field in includes/specials/MobileSpecialPageFeed.php. | ||
| CVE-2019-11274 | Med | 0.40 | 6.1 | 0.01 | Aug 9, 2019 | Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM filter that contains malicious JavaScript, which older browsers may execute. | ||
| CVE-2019-11776 | Med | 0.40 | 6.1 | 0.01 | Aug 9, 2019 | In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context. | ||
| CVE-2018-20858 | Med | 0.40 | 6.1 | 0.01 | Aug 9, 2019 | Recommender before 2018-07-18 allows XSS. | ||
| CVE-2019-14791 | Med | 0.40 | 6.1 | 0.01 | Aug 9, 2019 | The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter. | ||
| CVE-2019-14799 | Med | 0.40 | 6.1 | 0.02 | Aug 9, 2019 | The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS. | ||
| CVE-2017-18484 | Med | 0.40 | 6.1 | 0.01 | Aug 8, 2019 | Cognitoys Dino devices allow XSS via the SSID. | ||
| CVE-2019-14774 | Med | 0.40 | 6.1 | 0.01 | Aug 8, 2019 | The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter. | ||
| CVE-2019-12397 | Med | 0.40 | 6.1 | 0.03 | Aug 8, 2019 | Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix. | ||
| CVE-2019-14772 | Med | 0.40 | 6.1 | 0.01 | Aug 8, 2019 | verdaccio before 3.12.0 allows XSS. | ||
| CVE-2019-14770 | Med | 0.40 | 6.1 | 0.01 | Aug 8, 2019 | In Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3, some menu links within the administration bar may be crafted to execute JavaScript when the administrator is logged in and uses the search functionality. (This issue is mitigated by the attacker needing permissions… | ||
| CVE-2019-14769 | Med | 0.40 | 6.1 | 0.01 | Aug 8, 2019 | Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators. An attacker could potentially craft a specialized label, then have an administrator execute scripting when administering… | ||
| CVE-2019-14747 | Med | 0.40 | 6.1 | 0.01 | Aug 7, 2019 | DWSurvey through 2019-07-22 has stored XSS via the design/my-survey-design!copySurvey.action surveyName parameter. | ||
| CVE-2019-10376 | Med | 0.40 | 6.1 | 0.01 | Aug 7, 2019 | A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin. | ||
| CVE-2017-18483 | Med | 0.40 | 6.1 | 0.01 | Aug 7, 2019 | ANNKE SP1 HD wireless camera 3.4.1.1604071109 devices allow XSS via a crafted SSID. | ||
| CVE-2016-10795 | Med | 0.40 | 6.1 | 0.01 | Aug 6, 2019 | cPanel before 59.9999.145 allows stored XSS in the WHM tail_upcp2.cgi interface (SEC-156). |
- risk 0.40cvss 6.1epss 0.01
The wp-database-backup plugin before 4.3.1 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-database-backup plugin before 4.3.3 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.
- risk 0.40cvss 6.1epss 0.01
In the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit summary field in includes/specials/MobileSpecialPageFeed.php.
- risk 0.40cvss 6.1epss 0.01
Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM filter that contains malicious JavaScript, which older browsers may execute.
- risk 0.40cvss 6.1epss 0.01
In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context.
- risk 0.40cvss 6.1epss 0.01
Recommender before 2018-07-18 allows XSS.
- risk 0.40cvss 6.1epss 0.01
The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.
- risk 0.40cvss 6.1epss 0.02
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.
- risk 0.40cvss 6.1epss 0.01
Cognitoys Dino devices allow XSS via the SSID.
- risk 0.40cvss 6.1epss 0.01
The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter.
- risk 0.40cvss 6.1epss 0.03
Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix.
- risk 0.40cvss 6.1epss 0.01
verdaccio before 3.12.0 allows XSS.
- risk 0.40cvss 6.1epss 0.01
In Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3, some menu links within the administration bar may be crafted to execute JavaScript when the administrator is logged in and uses the search functionality. (This issue is mitigated by the attacker needing permissions…
- risk 0.40cvss 6.1epss 0.01
Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators. An attacker could potentially craft a specialized label, then have an administrator execute scripting when administering…
- risk 0.40cvss 6.1epss 0.01
DWSurvey through 2019-07-22 has stored XSS via the design/my-survey-design!copySurvey.action surveyName parameter.
- risk 0.40cvss 6.1epss 0.01
A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.
- risk 0.40cvss 6.1epss 0.01
ANNKE SP1 HD wireless camera 3.4.1.1604071109 devices allow XSS via a crafted SSID.
- risk 0.40cvss 6.1epss 0.01
cPanel before 59.9999.145 allows stored XSS in the WHM tail_upcp2.cgi interface (SEC-156).