CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 974 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-16779 | Med | 0.40 | 6.1 | 0.01 | Sep 10, 2018 | BlogCMS through 2016-10-25 has XSS via a comment. | ||
| CVE-2018-16759 | Med | 0.40 | 6.1 | 0.01 | Sep 9, 2018 | The removeXSS function in App/Common/common.php (called from App/Modules/Index/Action/SearchAction.class.php) in EasyCMS v1.4 allows XSS via an onhashchange event. | ||
| CVE-2018-16730 | Med | 0.40 | 6.1 | 0.01 | Sep 8, 2018 | \upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name. | ||
| CVE-2018-16725 | Med | 0.40 | 6.1 | 0.01 | Sep 8, 2018 | An issue is discovered in baijiacms V4. XSS exists via the assets/weengine/components/zclip/ZeroClipboard.swf id parameter, aka "Non-standard use of the flash component." | ||
| CVE-2018-0654 | Med | 0.40 | 6.1 | 0.01 | Sep 7, 2018 | Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the modal for creating Wiki page. | ||
| CVE-2018-0653 | Med | 0.40 | 6.1 | 0.01 | Sep 7, 2018 | Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via Wiki page view. | ||
| CVE-2018-0642 | Med | 0.40 | 6.1 | 0.01 | Sep 7, 2018 | Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2018-16655 | Med | 0.40 | 6.1 | 0.01 | Sep 7, 2018 | Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php. | ||
| CVE-2018-16654 | Med | 0.40 | 6.1 | 0.01 | Sep 7, 2018 | Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1. | ||
| CVE-2018-16653 | Med | 0.40 | 6.1 | 0.01 | Sep 7, 2018 | rejucms 2.1 has XSS via the ucenter/cms_user_add.php u_name parameter. | ||
| CVE-2018-16285 | Med | 0.40 | 6.1 | 0.01 | Sep 6, 2018 | The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php. | ||
| CVE-2018-5005 | Med | 0.40 | 6.1 | 0.04 | Sep 6, 2018 | Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a Cross-site Scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | ||
| CVE-2018-1000670 | Med | 0.40 | 6.1 | 0.01 | Sep 6, 2018 | KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Scripting (XSS) vulnerability in Multiple fields on multiple pages including /cgi-bin/koha/acqui/supplier.pl?op=enter , /cgi-bin/koha/circ/circulation.pl?borrowernumber=[… | ||
| CVE-2018-1000665 | Med | 0.40 | 6.1 | 0.01 | Sep 6, 2018 | Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in unit.html and testsDOH/_base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/_base/i18nExhaustive.js in the DOH that can result in Victim attacked… | ||
| CVE-2018-16459 | Med | 0.40 | 6.1 | 0.01 | Sep 6, 2018 | An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser. | ||
| CVE-2018-16381 | Med | 0.40 | 6.1 | 0.01 | Sep 5, 2018 | e107 2.1.8 has XSS via the e107_admin/users.php?mode=main&action=list user_loginname parameter. | ||
| CVE-2018-16361 | Med | 0.40 | 6.1 | 0.01 | Sep 5, 2018 | An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows XSS via the id parameter. | ||
| CVE-2018-16148 | Med | 0.40 | 6.1 | 0.01 | Sep 5, 2018 | The diagnosticsb2ksy parameter of the /rest endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site Scripting. | ||
| CVE-2018-16147 | Med | 0.40 | 6.1 | 0.01 | Sep 5, 2018 | The data parameter of the /settings/api/router endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site Scripting. | ||
| CVE-2018-15679 | Med | 0.40 | 6.1 | 0.01 | Sep 5, 2018 | An issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function available at /index.php?page=forums&action=search is vulnerable to reflected cross-site scripting. |
- risk 0.40cvss 6.1epss 0.01
BlogCMS through 2016-10-25 has XSS via a comment.
- risk 0.40cvss 6.1epss 0.01
The removeXSS function in App/Common/common.php (called from App/Modules/Index/Action/SearchAction.class.php) in EasyCMS v1.4 allows XSS via an onhashchange event.
- risk 0.40cvss 6.1epss 0.01
\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name.
- risk 0.40cvss 6.1epss 0.01
An issue is discovered in baijiacms V4. XSS exists via the assets/weengine/components/zclip/ZeroClipboard.swf id parameter, aka "Non-standard use of the flash component."
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the modal for creating Wiki page.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via Wiki page view.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php.
- risk 0.40cvss 6.1epss 0.01
Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1.
- risk 0.40cvss 6.1epss 0.01
rejucms 2.1 has XSS via the ucenter/cms_user_add.php u_name parameter.
- risk 0.40cvss 6.1epss 0.01
The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php.
- risk 0.40cvss 6.1epss 0.04
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a Cross-site Scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
- risk 0.40cvss 6.1epss 0.01
KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Scripting (XSS) vulnerability in Multiple fields on multiple pages including /cgi-bin/koha/acqui/supplier.pl?op=enter , /cgi-bin/koha/circ/circulation.pl?borrowernumber=[…
- risk 0.40cvss 6.1epss 0.01
Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in unit.html and testsDOH/_base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/_base/i18nExhaustive.js in the DOH that can result in Victim attacked…
- risk 0.40cvss 6.1epss 0.01
An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser.
- risk 0.40cvss 6.1epss 0.01
e107 2.1.8 has XSS via the e107_admin/users.php?mode=main&action=list user_loginname parameter.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows XSS via the id parameter.
- risk 0.40cvss 6.1epss 0.01
The diagnosticsb2ksy parameter of the /rest endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site Scripting.
- risk 0.40cvss 6.1epss 0.01
The data parameter of the /settings/api/router endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site Scripting.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function available at /index.php?page=forums&action=search is vulnerable to reflected cross-site scripting.