CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 953 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-9107 | Med | 0.40 | 6.1 | 0.01 | Feb 25, 2019 | XSS exists in WUZHI CMS 4.1.0 via index.php?m=attachment&f=imagecut&v=init&imgurl=[XSS] to coreframe/app/attachment/imagecut.php. | ||
| CVE-2018-18692 | Med | 0.40 | 6.1 | 0.01 | Feb 23, 2019 | A reflected Cross-Site scripting (XSS) vulnerability in SEMCO Semcosoft 5.3 allows remote attackers to inject arbitrary web scripts or HTML via the username parameter to the Login Form. | ||
| CVE-2019-9016 | Med | 0.40 | 6.1 | 0.01 | Feb 22, 2019 | An XSS vulnerability was discovered in MOPCMS through 2018-11-30. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[name] parameter in a mod=column request, as demonstrated by the /mopcms/X0AZgf(index).php?mod=column&ac=list&… | ||
| CVE-2019-1685 | Med | 0.40 | 6.1 | 0.01 | Feb 21, 2019 | A vulnerability in the Security Assertion Markup Language (SAML) single sign-on (SSO) interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. The… | ||
| CVE-2018-1947 | Med | 0.40 | 6.1 | 0.01 | Feb 21, 2019 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to… | ||
| CVE-2019-8984 | Med | 0.40 | 6.1 | 0.01 | Feb 21, 2019 | MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2). | ||
| CVE-2019-8983 | Med | 0.40 | 6.1 | 0.01 | Feb 21, 2019 | MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2). | ||
| CVE-2019-8939 | Med | 0.40 | 6.1 | 0.01 | Feb 19, 2019 | data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page. | ||
| CVE-2019-8911 | Med | 0.40 | 6.1 | 0.01 | Feb 18, 2019 | An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box (for the website statistics code). | ||
| CVE-2019-8434 | Med | 0.40 | 6.1 | 0.01 | Feb 18, 2019 | In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay parameter. | ||
| CVE-2019-8432 | Med | 0.40 | 6.1 | 0.01 | Feb 18, 2019 | In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter. | ||
| CVE-2019-8419 | Med | 0.40 | 6.1 | 0.01 | Feb 17, 2019 | VNote 2.2 has XSS via a new text note. | ||
| CVE-2019-8363 | Med | 0.40 | 6.1 | 0.01 | Feb 16, 2019 | Verydows 2.0 has XSS via the index.php?c=main a parameter, as demonstrated by an a=index[XSS] value. | ||
| CVE-2019-8361 | Med | 0.40 | 6.1 | 0.01 | Feb 16, 2019 | PHP Scripts Mall Responsive Video News Script has XSS via the Search Bar. This might, for example, be leveraged for HTML injection or URL redirection. | ||
| CVE-2019-0251 | Med | 0.40 | 6.1 | 0.01 | Feb 15, 2019 | The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2019-6589 | Med | 0.40 | 6.1 | 0.01 | Feb 14, 2019 | On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the BIG-IP TMUI (Traffic Management User Interface) also known as the BIG-IP configuration utility. | ||
| CVE-2018-12409 | Med | 0.40 | 6.1 | 0.01 | Feb 13, 2019 | The SOAP Admin API component of TIBCO Software Inc.'s TIBCO Silver Fabric contains a vulnerability that may allow reflected cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Silver Fabric: versions up to and including 5.8.1. | ||
| CVE-2019-8335 | Med | 0.40 | 6.1 | 0.01 | Feb 13, 2019 | An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&id=[XSS]. | ||
| CVE-2019-8334 | Med | 0.40 | 6.1 | 0.01 | Feb 13, 2019 | An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&viewid=[XSS]. | ||
| CVE-2019-7744 | Med | 0.40 | 6.1 | 0.01 | Feb 12, 2019 | An issue was discovered in Joomla! before 3.9.3. Inadequate filtering on URL fields in various core components could lead to an XSS vulnerability. |
- risk 0.40cvss 6.1epss 0.01
XSS exists in WUZHI CMS 4.1.0 via index.php?m=attachment&f=imagecut&v=init&imgurl=[XSS] to coreframe/app/attachment/imagecut.php.
- risk 0.40cvss 6.1epss 0.01
A reflected Cross-Site scripting (XSS) vulnerability in SEMCO Semcosoft 5.3 allows remote attackers to inject arbitrary web scripts or HTML via the username parameter to the Login Form.
- risk 0.40cvss 6.1epss 0.01
An XSS vulnerability was discovered in MOPCMS through 2018-11-30. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[name] parameter in a mod=column request, as demonstrated by the /mopcms/X0AZgf(index).php?mod=column&ac=list&…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the Security Assertion Markup Language (SAML) single sign-on (SSO) interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. The…
- risk 0.40cvss 6.1epss 0.01
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
- risk 0.40cvss 6.1epss 0.01
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2).
- risk 0.40cvss 6.1epss 0.01
MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2).
- risk 0.40cvss 6.1epss 0.01
data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box (for the website statistics code).
- risk 0.40cvss 6.1epss 0.01
In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay parameter.
- risk 0.40cvss 6.1epss 0.01
In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter.
- risk 0.40cvss 6.1epss 0.01
VNote 2.2 has XSS via a new text note.
- risk 0.40cvss 6.1epss 0.01
Verydows 2.0 has XSS via the index.php?c=main a parameter, as demonstrated by an a=index[XSS] value.
- risk 0.40cvss 6.1epss 0.01
PHP Scripts Mall Responsive Video News Script has XSS via the Search Bar. This might, for example, be leveraged for HTML injection or URL redirection.
- risk 0.40cvss 6.1epss 0.01
The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.01
On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the BIG-IP TMUI (Traffic Management User Interface) also known as the BIG-IP configuration utility.
- risk 0.40cvss 6.1epss 0.01
The SOAP Admin API component of TIBCO Software Inc.'s TIBCO Silver Fabric contains a vulnerability that may allow reflected cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Silver Fabric: versions up to and including 5.8.1.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&id=[XSS].
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&viewid=[XSS].
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Joomla! before 3.9.3. Inadequate filtering on URL fields in various core components could lead to an XSS vulnerability.