CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,541)
page 96 of 2,428| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-29152 | Hig | 0.49 | 7.6 | 0.00 | May 7, 2025 | Cross-Site Scripting vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via multiple components, including Strategic Planning Perspective Registration, Training Request, Perspective Editing, Education Registration, Hierarchical… | ||
| CVE-2025-3246 | Hig | 0.49 | 7.6 | 0.00 | Apr 17, 2025 | An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting in GitHub Markdown that used `$$..$$` math blocks. Exploitation required access to the target GitHub Enterprise Server instance and privileged user… | ||
| CVE-2025-27405 | Hig | 0.49 | 7.6 | 0.00 | Mar 26, 2025 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to… | ||
| CVE-2025-27404 | Hig | 0.49 | 7.6 | 0.01 | Mar 26, 2025 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to… | ||
| CVE-2025-2610 | Hig | 0.49 | 7.6 | 0.01 | Mar 21, 2025 | Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling (Alarm Module modules) allows authenticated stored cross-site scripting. This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue… | ||
| CVE-2024-26006 | Hig | 0.49 | 7.5 | 0.01 | Mar 14, 2025 | An improper neutralization of input during web page Generation vulnerability [CWE-79] in FortiOS version 7.4.3 and below, version 7.2.7 and below, version 7.0.13 and below and FortiProxy version 7.4.3 and below, version 7.2.9 and below, version 7.0.16 and below web SSL VPN UI… | ||
| CVE-2025-26907 | Hig | 0.49 | 7.5 | 0.00 | Feb 25, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Mortgage Calculator Estatik estatik-mortgage-calculator allows Stored XSS.This issue affects Mortgage Calculator Estatik: from n/a through <= 2.0.12. | ||
| CVE-2025-24885 | Hig | 0.49 | 7.6 | 0.00 | Jan 30, 2025 | pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Missing access control on rendering custom (unprivileged) dojo pages causes ability for users to create stored XSS. | ||
| CVE-2025-21612 | Hig | 0.49 | 8.6 | 0.01 | Jan 6, 2025 | TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2. | ||
| CVE-2024-47925 | Hig | 0.49 | 7.5 | 0.01 | Dec 30, 2024 | Tecnick TCExam – Multiple CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ||
| CVE-2024-47924 | Hig | 0.49 | 7.5 | 0.01 | Dec 30, 2024 | Boa web server – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ||
| CVE-2024-47920 | Hig | 0.49 | 7.5 | 0.01 | Dec 30, 2024 | Tiki Wiki CMS – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ||
| CVE-2024-47917 | — | Hig | 0.49 | 7.5 | 0.01 | Dec 30, 2024 | CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | |
| CVE-2024-49053 | Hig | 0.49 | 7.6 | 0.01 | Nov 26, 2024 | Microsoft Dynamics 365 Sales Spoofing Vulnerability | ||
| CVE-2022-26324 | Hig | 0.49 | 7.6 | 0.00 | Nov 22, 2024 | Possible XSS in iManager URL for access Component has been discovered in OpenText™ iManager 3.2.6.0000. | ||
| CVE-2024-48536 | Hig | 0.49 | 7.5 | 0.00 | Nov 20, 2024 | Incorrect access control in eSoft Planner 3.24.08271-USA allow attackers to view all transactions performed by the company via supplying a crafted web request. | ||
| CVE-2024-52598 | Hig | 0.49 | 7.5 | 0.01 | Nov 20, 2024 | 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5.4.1 a SSRF and URI validation bypass issue. The endpoint at POST /api/v1/twofaccounts/preview allows setting a remote… | ||
| CVE-2023-49952 | Hig | 0.49 | 7.5 | 0.00 | Nov 18, 2024 | Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header. | ||
| CVE-2024-45254 | — | Hig | 0.49 | 7.5 | 0.00 | Nov 14, 2024 | VaeMendis - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | |
| CVE-2020-11926 | Hig | 0.49 | 7.5 | 0.01 | Nov 7, 2024 | An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Clients can authenticate themselves to the device using a username and password. These credentials can be obtained through an unauthenticated web request, e.g., for a JavaScript file. Also, the disclosed… |
- risk 0.49cvss 7.6epss 0.00
Cross-Site Scripting vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via multiple components, including Strategic Planning Perspective Registration, Training Request, Perspective Editing, Education Registration, Hierarchical…
- risk 0.49cvss 7.6epss 0.00
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting in GitHub Markdown that used `$$..$$` math blocks. Exploitation required access to the target GitHub Enterprise Server instance and privileged user…
- risk 0.49cvss 7.6epss 0.00
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to…
- risk 0.49cvss 7.6epss 0.01
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to…
- risk 0.49cvss 7.6epss 0.01
Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling (Alarm Module modules) allows authenticated stored cross-site scripting. This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue…
- risk 0.49cvss 7.5epss 0.01
An improper neutralization of input during web page Generation vulnerability [CWE-79] in FortiOS version 7.4.3 and below, version 7.2.7 and below, version 7.0.13 and below and FortiProxy version 7.4.3 and below, version 7.2.9 and below, version 7.0.16 and below web SSL VPN UI…
- risk 0.49cvss 7.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Mortgage Calculator Estatik estatik-mortgage-calculator allows Stored XSS.This issue affects Mortgage Calculator Estatik: from n/a through <= 2.0.12.
- risk 0.49cvss 7.6epss 0.00
pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Missing access control on rendering custom (unprivileged) dojo pages causes ability for users to create stored XSS.
- risk 0.49cvss 8.6epss 0.01
TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2.
- risk 0.49cvss 7.5epss 0.01
Tecnick TCExam – Multiple CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- risk 0.49cvss 7.5epss 0.01
Boa web server – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- risk 0.49cvss 7.5epss 0.01
Tiki Wiki CMS – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- risk 0.49cvss 7.5epss 0.01
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- risk 0.49cvss 7.6epss 0.01
Microsoft Dynamics 365 Sales Spoofing Vulnerability
- risk 0.49cvss 7.6epss 0.00
Possible XSS in iManager URL for access Component has been discovered in OpenText™ iManager 3.2.6.0000.
- risk 0.49cvss 7.5epss 0.00
Incorrect access control in eSoft Planner 3.24.08271-USA allow attackers to view all transactions performed by the company via supplying a crafted web request.
- risk 0.49cvss 7.5epss 0.01
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5.4.1 a SSRF and URI validation bypass issue. The endpoint at POST /api/v1/twofaccounts/preview allows setting a remote…
- risk 0.49cvss 7.5epss 0.00
Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header.
- risk 0.49cvss 7.5epss 0.00
VaeMendis - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Clients can authenticate themselves to the device using a username and password. These credentials can be obtained through an unauthenticated web request, e.g., for a JavaScript file. Also, the disclosed…