CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 936 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-1010003 | Med | 0.40 | 6.1 | 0.01 | Jul 11, 2019 | Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS). | ||
| CVE-2019-13488 | Med | 0.40 | 6.1 | 0.01 | Jul 10, 2019 | A cross-site scripting (XSS) vulnerability in static/js/trape.js in Trape through 2019-05-08 allows remote attackers to inject arbitrary web script or HTML via the country, query, or refer parameter to the /register URI, because the jQuery prepend() method is used. | ||
| CVE-2019-0329 | Med | 0.40 | 6.1 | 0.01 | Jul 10, 2019 | SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2019-0326 | Med | 0.40 | 6.1 | 0.01 | Jul 10, 2019 | SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2019-0321 | Med | 0.40 | 6.1 | 0.01 | Jul 10, 2019 | ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2019-0281 | Med | 0.40 | 6.1 | 0.01 | Jul 10, 2019 | SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2018-11734 | — | Med | 0.40 | 6.1 | 0.01 | Jul 10, 2019 | In e107 v2.1.7, output without filtering results in XSS. | |
| CVE-2019-13122 | Med | 0.40 | 6.1 | 0.01 | Jul 10, 2019 | A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This… | ||
| CVE-2019-12471 | Med | 0.40 | 6.1 | 0.01 | Jul 10, 2019 | Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on users loading that script. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. | ||
| CVE-2018-19493 | Med | 0.40 | 6.1 | 0.01 | Jul 10, 2019 | An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is a persistent XSS vulnerability in the environment pages due to a lack of input validation and output encoding. | ||
| CVE-2017-6217 | Med | 0.40 | 6.1 | 0.01 | Jul 10, 2019 | paypal/adaptivepayments-sdk-php v3.9.2 is vulnerable to a reflected XSS in the SetPaymentOptions.php resulting code execution | ||
| CVE-2019-12724 | Med | 0.40 | 6.1 | 0.01 | Jul 10, 2019 | An issue was discovered in the Teclib News plugin through 1.5.2 for GLPI. It allows a stored XSS attack via the $_POST['name'] parameter. | ||
| CVE-2018-12627 | Med | 0.40 | 6.1 | 0.01 | Jul 10, 2019 | An issue was discovered in Eventum 3.5.0. /htdocs/list.php has XSS via the show_notification_list_issues or show_authorized_issues parameter. | ||
| CVE-2018-12626 | Med | 0.40 | 6.1 | 0.01 | Jul 10, 2019 | An issue was discovered in Eventum 3.5.0. /htdocs/popup.php has XSS via the cat parameter. | ||
| CVE-2018-12625 | Med | 0.40 | 6.1 | 0.01 | Jul 10, 2019 | An issue was discovered in Eventum 3.5.0. /htdocs/validate.php has XSS via the values parameter. | ||
| CVE-2018-12623 | Med | 0.40 | 6.1 | 0.01 | Jul 10, 2019 | An issue was discovered in Eventum 3.5.0. htdocs/switch.php has XSS via the current_page parameter. | ||
| CVE-2018-12622 | Med | 0.40 | 6.1 | 0.01 | Jul 10, 2019 | An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the field_name parameter. | ||
| CVE-2019-13472 | Med | 0.40 | 6.1 | 0.01 | Jul 9, 2019 | PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file. | ||
| CVE-2019-13380 | Med | 0.40 | 6.1 | 0.01 | Jul 9, 2019 | KEYNTO Team Password Manager 1.5.0 allows XSS because data saved from websites is mishandled in the online vault. | ||
| CVE-2019-8920 | Med | 0.40 | 6.1 | 0.01 | Jul 9, 2019 | iart.php in XAMPP 1.7.0 has XSS, a related issue to CVE-2008-3569. |
- risk 0.40cvss 6.1epss 0.01
Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in static/js/trape.js in Trape through 2019-05-08 allows remote attackers to inject arbitrary web script or HTML via the country, query, or refer parameter to the /register URI, because the jQuery prepend() method is used.
- risk 0.40cvss 6.1epss 0.01
SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
In e107 v2.1.7, output without filtering results in XSS.
- risk 0.40cvss 6.1epss 0.01
A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This…
- risk 0.40cvss 6.1epss 0.01
Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on users loading that script. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is a persistent XSS vulnerability in the environment pages due to a lack of input validation and output encoding.
- risk 0.40cvss 6.1epss 0.01
paypal/adaptivepayments-sdk-php v3.9.2 is vulnerable to a reflected XSS in the SetPaymentOptions.php resulting code execution
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in the Teclib News plugin through 1.5.2 for GLPI. It allows a stored XSS attack via the $_POST['name'] parameter.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Eventum 3.5.0. /htdocs/list.php has XSS via the show_notification_list_issues or show_authorized_issues parameter.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Eventum 3.5.0. /htdocs/popup.php has XSS via the cat parameter.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Eventum 3.5.0. /htdocs/validate.php has XSS via the values parameter.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Eventum 3.5.0. htdocs/switch.php has XSS via the current_page parameter.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the field_name parameter.
- risk 0.40cvss 6.1epss 0.01
PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file.
- risk 0.40cvss 6.1epss 0.01
KEYNTO Team Password Manager 1.5.0 allows XSS because data saved from websites is mishandled in the online vault.
- risk 0.40cvss 6.1epss 0.01
iart.php in XAMPP 1.7.0 has XSS, a related issue to CVE-2008-3569.