CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 952 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-14499 | Med | 0.40 | 6.1 | 0.01 | Mar 7, 2019 | An issue was found in HYBBS through 2016-03-08. There is an XSS vulnerablity via an article title to post.html. | ||
| CVE-2013-7467 | Med | 0.40 | 6.1 | 0.01 | Mar 7, 2019 | Simple Machines Forum (SMF) 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter. | ||
| CVE-2019-9595 | Med | 0.40 | 6.1 | 0.01 | Mar 6, 2019 | AppCMS 2.0.101 allows XSS via the upload/callback.php params parameter. | ||
| CVE-2019-9576 | Med | 0.40 | 6.1 | 0.01 | Mar 5, 2019 | The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS. | ||
| CVE-2019-9575 | Med | 0.40 | 6.1 | 0.02 | Mar 5, 2019 | The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS. | ||
| CVE-2019-6565 | Med | 0.40 | 6.1 | 0.01 | Mar 5, 2019 | Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attacks, which may be used to send a malicious script. | ||
| CVE-2019-6229 | Med | 0.40 | 6.1 | 0.01 | Mar 5, 2019 | A logic issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to universal cross site scripting. | ||
| CVE-2019-6228 | Med | 0.40 | 6.1 | 0.01 | Mar 5, 2019 | A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue is fixed in iOS 12.1.3, Safari 12.0.3. Processing maliciously crafted web content may lead to a cross site scripting attack. | ||
| CVE-2019-9567 | Med | 0.40 | 6.1 | 0.01 | Mar 4, 2019 | The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll. | ||
| CVE-2019-8278 | Med | 0.40 | 6.1 | 0.02 | Mar 2, 2019 | Stored XSS in Invision Power Board versions 3.3.1 - 3.4.8 leads to Remote Code Execution. | ||
| CVE-2019-9226 | Med | 0.40 | 6.1 | 0.01 | Feb 28, 2019 | An issue was discovered in baigo CMS 2.1.1. There is a persistent XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the opt[base][BG_SITE_NAME] parameter to the bg_console/index.php?m=opt&c=request URI. | ||
| CVE-2019-8410 | Med | 0.40 | 6.1 | 0.01 | Feb 27, 2019 | Maccms 8.0 allows XSS via the inc/config/cache.php t_key parameter because template/paody/html/vod_type.html mishandles the keywords parameter, and a/tpl/module/db.php only filters the t_name parameter (not t_key). | ||
| CVE-2019-6595 | Med | 0.40 | 6.1 | 0.01 | Feb 26, 2019 | Cross-site scripting (XSS) vulnerability in F5 BIG-IP Access Policy Manager (APM) 11.5.x and 11.6.x Admin Web UI. | ||
| CVE-2019-9168 | Med | 0.40 | 6.1 | 0.01 | Feb 26, 2019 | WooCommerce before 3.5.5 allows XSS via a Photoswipe caption. | ||
| CVE-2019-9145 | Med | 0.40 | 6.1 | 0.01 | Feb 25, 2019 | An issue was discovered in Hsycms V1.1. There is an XSS vulnerability via the name field to the /book page. | ||
| CVE-2019-9142 | Med | 0.40 | 6.1 | 0.01 | Feb 25, 2019 | An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java. | ||
| CVE-2018-20791 | Med | 0.40 | 6.1 | 0.01 | Feb 25, 2019 | tecrail Responsive FileManager 9.13.4 allows XSS via a media file upload with an XSS payload in the name, because of mishandling of the media_preview action. | ||
| CVE-2019-9110 | Med | 0.40 | 6.1 | 0.01 | Feb 25, 2019 | XSS exists in WUZHI CMS 4.1.0 via index.php?m=content&f=postinfo&v=listing&set_iframe=[XSS] to coreframe/app/content/postinfo.php. | ||
| CVE-2019-9109 | Med | 0.40 | 6.1 | 0.01 | Feb 25, 2019 | XSS exists in WUZHI CMS 4.1.0 via index.php?m=message&f=message&v=add&username=[XSS] to coreframe/app/message/message.php. | ||
| CVE-2019-9108 | Med | 0.40 | 6.1 | 0.01 | Feb 25, 2019 | XSS exists in WUZHI CMS 4.1.0 via index.php?m=core&f=map&v=baidumap&x=[XSS]&y=[XSS] to coreframe/app/core/map.php. |
- risk 0.40cvss 6.1epss 0.01
An issue was found in HYBBS through 2016-03-08. There is an XSS vulnerablity via an article title to post.html.
- risk 0.40cvss 6.1epss 0.01
Simple Machines Forum (SMF) 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter.
- risk 0.40cvss 6.1epss 0.01
AppCMS 2.0.101 allows XSS via the upload/callback.php params parameter.
- risk 0.40cvss 6.1epss 0.01
The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS.
- risk 0.40cvss 6.1epss 0.02
The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.
- risk 0.40cvss 6.1epss 0.01
Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attacks, which may be used to send a malicious script.
- risk 0.40cvss 6.1epss 0.01
A logic issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to universal cross site scripting.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue is fixed in iOS 12.1.3, Safari 12.0.3. Processing maliciously crafted web content may lead to a cross site scripting attack.
- risk 0.40cvss 6.1epss 0.01
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.
- risk 0.40cvss 6.1epss 0.02
Stored XSS in Invision Power Board versions 3.3.1 - 3.4.8 leads to Remote Code Execution.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in baigo CMS 2.1.1. There is a persistent XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the opt[base][BG_SITE_NAME] parameter to the bg_console/index.php?m=opt&c=request URI.
- risk 0.40cvss 6.1epss 0.01
Maccms 8.0 allows XSS via the inc/config/cache.php t_key parameter because template/paody/html/vod_type.html mishandles the keywords parameter, and a/tpl/module/db.php only filters the t_name parameter (not t_key).
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in F5 BIG-IP Access Policy Manager (APM) 11.5.x and 11.6.x Admin Web UI.
- risk 0.40cvss 6.1epss 0.01
WooCommerce before 3.5.5 allows XSS via a Photoswipe caption.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Hsycms V1.1. There is an XSS vulnerability via the name field to the /book page.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java.
- risk 0.40cvss 6.1epss 0.01
tecrail Responsive FileManager 9.13.4 allows XSS via a media file upload with an XSS payload in the name, because of mishandling of the media_preview action.
- risk 0.40cvss 6.1epss 0.01
XSS exists in WUZHI CMS 4.1.0 via index.php?m=content&f=postinfo&v=listing&set_iframe=[XSS] to coreframe/app/content/postinfo.php.
- risk 0.40cvss 6.1epss 0.01
XSS exists in WUZHI CMS 4.1.0 via index.php?m=message&f=message&v=add&username=[XSS] to coreframe/app/message/message.php.
- risk 0.40cvss 6.1epss 0.01
XSS exists in WUZHI CMS 4.1.0 via index.php?m=core&f=map&v=baidumap&x=[XSS]&y=[XSS] to coreframe/app/core/map.php.