CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 959 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-19904 | Med | 0.40 | 6.1 | 0.01 | Dec 31, 2018 | Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field. | ||
| CVE-2018-19903 | Med | 0.40 | 6.1 | 0.01 | Dec 31, 2018 | Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field. | ||
| CVE-2018-20611 | Med | 0.40 | 6.1 | 0.01 | Dec 30, 2018 | imcat 4.4 allow XSS via a crafted cookie to the root/tools/adbug/binfo.php?cookie URI. | ||
| CVE-2018-20600 | Med | 0.40 | 6.1 | 0.01 | Dec 30, 2018 | sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmin_cedit action. | ||
| CVE-2018-20583 | Med | 0.40 | 6.1 | 0.02 | Dec 30, 2018 | Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allow_unsafe_links is false) via a newline character (e.g., writing javascript as… | ||
| CVE-2018-1000629 | Med | 0.40 | 6.1 | 0.01 | Dec 28, 2018 | Battelle V2I Hub 2.5.1 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by api/SystemConfigActions.php?action=add and the index.php script. A remote attacker could exploit this vulnerability using the parameterName or _login_username… | ||
| CVE-2018-20524 | Med | 0.40 | 6.1 | 0.01 | Dec 27, 2018 | The Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of < in a message, because a danmuWrapper DIV element in chatbox-only\danmu.js is outside the scope of a Content Security Policy (CSP). | ||
| CVE-2018-20520 | Med | 0.40 | 6.1 | 0.01 | Dec 27, 2018 | MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233. | ||
| CVE-2018-19615 | Med | 0.40 | 6.1 | 0.03 | Dec 26, 2018 | Rockwell Automation Allen-Bradley PowerMonitor 1000 all versions. A remote attacker could inject arbitrary code into a targeted userâs web browser to gain access to the affected device. | ||
| CVE-2018-20486 | Med | 0.40 | 6.1 | 0.01 | Dec 26, 2018 | MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter. | ||
| CVE-2018-0724 | Med | 0.40 | 6.1 | 0.01 | Dec 26, 2018 | Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject Javascript code in the compromised application, a different vulnerability than CVE-2018-0723. | ||
| CVE-2018-0723 | Med | 0.40 | 6.1 | 0.01 | Dec 26, 2018 | Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject Javascript code in the compromised application, a different vulnerability than CVE-2018-0724. | ||
| CVE-2018-20476 | Med | 0.40 | 6.1 | 0.01 | Dec 26, 2018 | An issue was discovered in S-CMS 3.0. It allows XSS via the admin/demo.php T_id parameter. | ||
| CVE-2018-20464 | Med | 0.40 | 6.1 | 0.01 | Dec 25, 2018 | There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mailbox with the wrong format. The response contains the user's previously entered email address. | ||
| CVE-2018-20462 | Med | 0.40 | 6.1 | 0.04 | Dec 25, 2018 | An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the jsmol.php data parameter. | ||
| CVE-2018-20454 | Med | 0.40 | 6.1 | 0.01 | Dec 25, 2018 | An issue was discovered in 74cms v4.2.111. upload/index.php?c=resume&a=resume_list has XSS via the key parameter. | ||
| CVE-2018-20369 | Med | 0.40 | 6.1 | 0.01 | Dec 23, 2018 | Barracuda Message Archiver 2018 has XSS in the error_msg exception-handling value for the ldap_user parameter to the cgi-mod/ldap_load_entry.cgi module. The injection point of the issue is the Add_Update module. | ||
| CVE-2018-20367 | Med | 0.40 | 6.1 | 0.01 | Dec 22, 2018 | The "mall some commodity details: commodity consultation" component in WSTMart 2.0.8_181212 has stored XSS via the consultContent parameter, as demonstrated by the index.php/home/goodsconsult/add.html URI. | ||
| CVE-2018-20351 | Med | 0.40 | 6.1 | 0.01 | Dec 22, 2018 | The Markdown component in Evernote (Chinese) before 8.3.2 on macOS allows stored XSS, aka MAC-832. | ||
| CVE-2018-20322 | Med | 0.40 | 6.1 | 0.01 | Dec 21, 2018 | LimeSurvey version 3.15.5 contains a Cross-site scripting (XSS) vulnerability in Survey Resource zip upload, resulting in Javascript code execution against LimeSurvey administrators. Fixed in version 3.15.6. |
- risk 0.40cvss 6.1epss 0.01
Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field.
- risk 0.40cvss 6.1epss 0.01
Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field.
- risk 0.40cvss 6.1epss 0.01
imcat 4.4 allow XSS via a crafted cookie to the root/tools/adbug/binfo.php?cookie URI.
- risk 0.40cvss 6.1epss 0.01
sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmin_cedit action.
- risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allow_unsafe_links is false) via a newline character (e.g., writing javascript as…
- risk 0.40cvss 6.1epss 0.01
Battelle V2I Hub 2.5.1 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by api/SystemConfigActions.php?action=add and the index.php script. A remote attacker could exploit this vulnerability using the parameterName or _login_username…
- risk 0.40cvss 6.1epss 0.01
The Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of < in a message, because a danmuWrapper DIV element in chatbox-only\danmu.js is outside the scope of a Content Security Policy (CSP).
- risk 0.40cvss 6.1epss 0.01
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233.
- risk 0.40cvss 6.1epss 0.03
Rockwell Automation Allen-Bradley PowerMonitor 1000 all versions. A remote attacker could inject arbitrary code into a targeted userâs web browser to gain access to the affected device.
- risk 0.40cvss 6.1epss 0.01
MetInfo 6.x through 6.1.3 has XSS via the /admin/login/login_check.php url_array[] parameter.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject Javascript code in the compromised application, a different vulnerability than CVE-2018-0723.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject Javascript code in the compromised application, a different vulnerability than CVE-2018-0724.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in S-CMS 3.0. It allows XSS via the admin/demo.php T_id parameter.
- risk 0.40cvss 6.1epss 0.01
There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mailbox with the wrong format. The response contains the user's previously entered email address.
- risk 0.40cvss 6.1epss 0.04
An issue was discovered in the JSmol2WP plugin 1.07 for WordPress. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the jsmol.php data parameter.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in 74cms v4.2.111. upload/index.php?c=resume&a=resume_list has XSS via the key parameter.
- risk 0.40cvss 6.1epss 0.01
Barracuda Message Archiver 2018 has XSS in the error_msg exception-handling value for the ldap_user parameter to the cgi-mod/ldap_load_entry.cgi module. The injection point of the issue is the Add_Update module.
- risk 0.40cvss 6.1epss 0.01
The "mall some commodity details: commodity consultation" component in WSTMart 2.0.8_181212 has stored XSS via the consultContent parameter, as demonstrated by the index.php/home/goodsconsult/add.html URI.
- risk 0.40cvss 6.1epss 0.01
The Markdown component in Evernote (Chinese) before 8.3.2 on macOS allows stored XSS, aka MAC-832.
- risk 0.40cvss 6.1epss 0.01
LimeSurvey version 3.15.5 contains a Cross-site scripting (XSS) vulnerability in Survey Resource zip upload, resulting in Javascript code execution against LimeSurvey administrators. Fixed in version 3.15.6.