CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 941 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-13375 | Med | 0.40 | 6.1 | 0.01 | May 28, 2019 | An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request containing malicious scripts in the HOSTNAME parameter. The malicious script code is executed while viewing… | ||
| CVE-2019-12362 | Med | 0.40 | 6.1 | 0.01 | May 27, 2019 | EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php. | ||
| CVE-2019-12361 | Med | 0.40 | 6.1 | 0.00 | May 27, 2019 | EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page. | ||
| CVE-2019-12345 | Med | 0.40 | 6.1 | 0.01 | May 27, 2019 | XSS exists in the Kiboko Hostel plugin before 1.1.4 for WordPress. | ||
| CVE-2019-7092 | Med | 0.40 | 6.1 | 0.02 | May 24, 2019 | ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a cross site scripting vulnerability. Successful exploitation could lead to information disclosure . | ||
| CVE-2018-12624 | Med | 0.40 | 6.1 | 0.01 | May 24, 2019 | An issue was discovered in Eventum 3.5.0. /htdocs/post_note.php has XSS via the garlic_prefix parameter. | ||
| CVE-2019-8346 | Med | 0.40 | 6.1 | 0.04 | May 24, 2019 | In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD… | ||
| CVE-2019-11604 | Med | 0.40 | 6.1 | 0.02 | May 24, 2019 | An issue was discovered in Quest KACE Systems Management Appliance before 9.1. The script at /service/kbot_service_notsoap.php is vulnerable to unauthenticated reflected XSS when user-supplied input to the METHOD GET parameter is processed by the web application. Since the… | ||
| CVE-2019-12315 | Med | 0.40 | 6.1 | 0.01 | May 24, 2019 | Samsung SCX-824 printers allow a reflected Cross-Site-Scripting (XSS) vulnerability that can be triggered by using the "print from file" feature, as demonstrated by the sws/swsAlert.sws?popupid=successMsg msg parameter. | ||
| CVE-2019-11876 | Med | 0.40 | 6.1 | 0.01 | May 24, 2019 | In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup (accepting terms and conditions) before executing… | ||
| CVE-2018-19614 | Med | 0.40 | 6.1 | 0.01 | May 23, 2019 | XSS exists in the /cmdexec/cmdexe?cmd= function in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers. | ||
| CVE-2017-11739 | Med | 0.40 | 6.1 | 0.03 | May 23, 2019 | In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashboard. This widget can be a "Utility Widget" with a "Custom HTML or Text" field. Once this widget is created, it will be… | ||
| CVE-2017-5213 | Med | 0.40 | 6.1 | 0.01 | May 23, 2019 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS). | ||
| CVE-2017-15030 | Med | 0.40 | 6.1 | 0.01 | May 23, 2019 | Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). | ||
| CVE-2018-7834 | Med | 0.40 | 6.1 | 0.01 | May 22, 2019 | A CWE-79 Cross-Site Scripting vulnerability exists in all versions of the TSXETG100 allowing an attacker to send a specially crafted URL with an embedded script to a user that would then be executed within the context of that user. | ||
| CVE-2017-9808 | Med | 0.40 | 6.1 | 0.01 | May 22, 2019 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). | ||
| CVE-2017-5864 | Med | 0.40 | 6.1 | 0.01 | May 22, 2019 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS). | ||
| CVE-2019-3402 | Med | 0.40 | 6.1 | 0.09 | May 22, 2019 | The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter. | ||
| CVE-2019-12167 | Med | 0.40 | 6.1 | 0.01 | May 22, 2019 | httpGetSet/httpGet.htm on Emerson Network Power Liebert Challenger 5.1E0.5 devices allows XSS via the statusstr parameter. | ||
| CVE-2018-7202 | Med | 0.40 | 6.1 | 0.01 | May 22, 2019 | An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page. |
- risk 0.40cvss 6.1epss 0.01
An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request containing malicious scripts in the HOSTNAME parameter. The malicious script code is executed while viewing…
- risk 0.40cvss 6.1epss 0.01
EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php.
- risk 0.40cvss 6.1epss 0.00
EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page.
- risk 0.40cvss 6.1epss 0.01
XSS exists in the Kiboko Hostel plugin before 1.1.4 for WordPress.
- risk 0.40cvss 6.1epss 0.02
ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a cross site scripting vulnerability. Successful exploitation could lead to information disclosure .
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Eventum 3.5.0. /htdocs/post_note.php has XSS via the garlic_prefix parameter.
- risk 0.40cvss 6.1epss 0.04
In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD…
- risk 0.40cvss 6.1epss 0.02
An issue was discovered in Quest KACE Systems Management Appliance before 9.1. The script at /service/kbot_service_notsoap.php is vulnerable to unauthenticated reflected XSS when user-supplied input to the METHOD GET parameter is processed by the web application. Since the…
- risk 0.40cvss 6.1epss 0.01
Samsung SCX-824 printers allow a reflected Cross-Site-Scripting (XSS) vulnerability that can be triggered by using the "print from file" feature, as demonstrated by the sws/swsAlert.sws?popupid=successMsg msg parameter.
- risk 0.40cvss 6.1epss 0.01
In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup (accepting terms and conditions) before executing…
- risk 0.40cvss 6.1epss 0.01
XSS exists in the /cmdexec/cmdexe?cmd= function in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers.
- risk 0.40cvss 6.1epss 0.03
In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashboard. This widget can be a "Utility Widget" with a "Custom HTML or Text" field. Once this widget is created, it will be…
- risk 0.40cvss 6.1epss 0.01
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.01
Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.01
A CWE-79 Cross-Site Scripting vulnerability exists in all versions of the TSXETG100 allowing an attacker to send a specially crafted URL with an embedded script to a user that would then be executed within the context of that user.
- risk 0.40cvss 6.1epss 0.01
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.01
Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS).
- risk 0.40cvss 6.1epss 0.09
The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.
- risk 0.40cvss 6.1epss 0.01
httpGetSet/httpGet.htm on Emerson Network Power Liebert Challenger 5.1E0.5 devices allows XSS via the statusstr parameter.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page.