CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 946 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-11084 | Med | 0.40 | 6.1 | 0.01 | Apr 18, 2019 | GAuth 0.9.9 beta has stored XSS that shows a popup repeatedly and discloses cookies. | ||
| CVE-2019-1792 | Med | 0.40 | 6.1 | 0.01 | Apr 18, 2019 | A vulnerability in the URL block page of Cisco Umbrella could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user in a network protected by Umbrella. The vulnerability is due to insufficient validation of input parameters… | ||
| CVE-2019-1719 | Med | 0.40 | 6.1 | 0.01 | Apr 18, 2019 | A vulnerability in the web-based guest portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient… | ||
| CVE-2018-13809 | Med | 0.40 | 6.1 | 0.01 | Apr 17, 2019 | A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). The integrated web server of the affected CP devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into following a malicious link. User interaction is… | ||
| CVE-2018-18019 | Med | 0.40 | 6.1 | 0.01 | Apr 15, 2019 | XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide[title], Slide[media_file], or Slide[image_url] parameter. | ||
| CVE-2018-18017 | Med | 0.40 | 6.1 | 0.01 | Apr 15, 2019 | XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter. | ||
| CVE-2018-16967 | Med | 0.40 | 6.1 | 0.01 | Apr 15, 2019 | There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter. | ||
| CVE-2018-17586 | Med | 0.40 | 6.1 | 0.01 | Apr 15, 2019 | The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_timeout_pages action. | ||
| CVE-2018-17585 | Med | 0.40 | 6.1 | 0.01 | Apr 15, 2019 | The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the wpfastestcacheoptions wpFastestCachePreload_number or wpFastestCacheLanguage parameter. | ||
| CVE-2018-17583 | Med | 0.40 | 6.1 | 0.01 | Apr 15, 2019 | The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_exclude_pages action. | ||
| CVE-2018-18261 | Med | 0.40 | 6.1 | 0.01 | Apr 15, 2019 | In waimai Super Cms 20150505, there is an XSS vulnerability via the /admin.php/Foodcat/addsave fcname parameter. | ||
| CVE-2018-16259 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2019 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be… | ||
| CVE-2018-16258 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2019 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken… | ||
| CVE-2018-16257 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2019 | There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken… | ||
| CVE-2018-16256 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2019 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken… | ||
| CVE-2018-16255 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2019 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by… | ||
| CVE-2018-16254 | Med | 0.40 | 6.1 | 0.01 | Apr 12, 2019 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by… | ||
| CVE-2018-19202 | Med | 0.40 | 6.1 | 0.01 | Apr 11, 2019 | A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript via the 'upsetting[bburl]' parameter. | ||
| CVE-2019-7219 | Med | 0.40 | 6.1 | 0.05 | Apr 11, 2019 | Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE: this is a discontinued product. The issue was fixed in later Zarafa Webapp versions; however, some former Zarafa Webapp customers use the related Kopano product instead. | ||
| CVE-2018-14683 | Med | 0.40 | 6.1 | 0.01 | Apr 10, 2019 | PRTG before 19.1.49.1966 has Cross Site Scripting (XSS) in the WEBGUI. |
- risk 0.40cvss 6.1epss 0.01
GAuth 0.9.9 beta has stored XSS that shows a popup repeatedly and discloses cookies.
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the URL block page of Cisco Umbrella could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user in a network protected by Umbrella. The vulnerability is due to insufficient validation of input parameters…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based guest portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient…
- risk 0.40cvss 6.1epss 0.01
A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). The integrated web server of the affected CP devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into following a malicious link. User interaction is…
- risk 0.40cvss 6.1epss 0.01
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide[title], Slide[media_file], or Slide[image_url] parameter.
- risk 0.40cvss 6.1epss 0.01
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter.
- risk 0.40cvss 6.1epss 0.01
There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.
- risk 0.40cvss 6.1epss 0.01
The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_timeout_pages action.
- risk 0.40cvss 6.1epss 0.01
The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the wpfastestcacheoptions wpFastestCachePreload_number or wpFastestCacheLanguage parameter.
- risk 0.40cvss 6.1epss 0.01
The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_exclude_pages action.
- risk 0.40cvss 6.1epss 0.01
In waimai Super Cms 20150505, there is an XSS vulnerability via the /admin.php/Foodcat/addsave fcname parameter.
- risk 0.40cvss 6.1epss 0.01
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be…
- risk 0.40cvss 6.1epss 0.01
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken…
- risk 0.40cvss 6.1epss 0.01
There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken…
- risk 0.40cvss 6.1epss 0.01
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken…
- risk 0.40cvss 6.1epss 0.01
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by…
- risk 0.40cvss 6.1epss 0.01
There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by…
- risk 0.40cvss 6.1epss 0.01
A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript via the 'upsetting[bburl]' parameter.
- risk 0.40cvss 6.1epss 0.05
Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE: this is a discontinued product. The issue was fixed in later Zarafa Webapp versions; however, some former Zarafa Webapp customers use the related Kopano product instead.
- risk 0.40cvss 6.1epss 0.01
PRTG before 19.1.49.1966 has Cross Site Scripting (XSS) in the WEBGUI.