CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 975 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-15678 | Med | 0.40 | 6.1 | 0.01 | Sep 5, 2018 | An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting. | ||
| CVE-2018-15677 | Med | 0.40 | 6.1 | 0.00 | Sep 5, 2018 | The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. This is also exploitable via CSRF. | ||
| CVE-2018-0672 | Med | 0.40 | 6.1 | 0.01 | Sep 4, 2018 | Cross-site scripting vulnerability in Movable Type versions prior to Ver. 6.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2018-16450 | Med | 0.40 | 6.1 | 0.01 | Sep 4, 2018 | CraftedWeb through 2013-09-24 has reflected XSS via the p parameter. | ||
| CVE-2018-16407 | Med | 0.40 | 6.1 | 0.01 | Sep 3, 2018 | An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS because tag label values are mishandled. | ||
| CVE-2018-16406 | Med | 0.40 | 6.1 | 0.01 | Sep 3, 2018 | An issue was discovered in Mayan EDMS before 3.0.2. The Cabinets app has XSS via a crafted cabinet label. | ||
| CVE-2018-16405 | Med | 0.40 | 6.1 | 0.01 | Sep 3, 2018 | An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets window.location directly, leading to XSS. | ||
| CVE-2018-16372 | Med | 0.40 | 6.1 | 0.01 | Sep 3, 2018 | The issue was discovered in IdeaCMS through 2016-04-30. There is reflected XSS via the index.php?c=content&a=search kw parameter. NOTE: this product is discontinued. | ||
| CVE-2018-16371 | Med | 0.40 | 6.1 | 0.01 | Sep 3, 2018 | PESCMS Team 2.2.1 has multiple reflected XSS via the keyword parameter: g=Team&m=User&a=index&keyword=, g=Team&m=User_group&a=index&keyword=, g=Team&m=Department&a=index&keyword=, and g=Team&m=Bulletin&a=index&keyword=. | ||
| CVE-2018-16362 | Med | 0.40 | 6.1 | 0.02 | Sep 2, 2018 | An issue was discovered in the Source Integration plugin before 1.5.9 and 2.x before 2.1.5 for MantisBT. A cross-site scripting (XSS) vulnerability in the Manage Repository and Changesets List pages allows execution of arbitrary code (if CSP settings permit it) via… | ||
| CVE-2018-16350 | Med | 0.40 | 6.1 | 0.01 | Sep 2, 2018 | WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic form[statcode] parameter. | ||
| CVE-2018-16349 | Med | 0.40 | 6.1 | 0.01 | Sep 2, 2018 | WUZHI CMS 4.1.0 has XSS via the index.php?m=link&f=index&v=add form[remark] parameter. | ||
| CVE-2018-16347 | Med | 0.40 | 6.1 | 0.01 | Sep 2, 2018 | An issue was discovered in Gleez CMS v1.2.0. There is XSS via media/imagecache/resize. | ||
| CVE-2018-16330 | Med | 0.40 | 6.1 | 0.01 | Sep 2, 2018 | Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element. | ||
| CVE-2018-16325 | Med | 0.40 | 6.1 | 0.01 | Sep 1, 2018 | There is XSS in GetSimple CMS 3.4.0.9 via the admin/edit.php title field. | ||
| CVE-2018-16324 | Med | 0.40 | 6.1 | 0.01 | Sep 1, 2018 | In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field. | ||
| CVE-2018-16313 | Med | 0.40 | 6.1 | 0.01 | Sep 1, 2018 | Bludit 2.3.4 allows XSS via a user name. | ||
| CVE-2018-16298 | — | Med | 0.40 | 6.1 | 0.01 | Aug 31, 2018 | An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request. | |
| CVE-2018-16236 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2018 | cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering. | ||
| CVE-2018-16234 | Med | 0.40 | 6.1 | 0.01 | Aug 30, 2018 | MorningStar WhatWeb 0.4.9 has XSS via JSON report files. |
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting.
- risk 0.40cvss 6.1epss 0.00
The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. This is also exploitable via CSRF.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Movable Type versions prior to Ver. 6.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
CraftedWeb through 2013-09-24 has reflected XSS via the p parameter.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS because tag label values are mishandled.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Mayan EDMS before 3.0.2. The Cabinets app has XSS via a crafted cabinet label.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets window.location directly, leading to XSS.
- risk 0.40cvss 6.1epss 0.01
The issue was discovered in IdeaCMS through 2016-04-30. There is reflected XSS via the index.php?c=content&a=search kw parameter. NOTE: this product is discontinued.
- risk 0.40cvss 6.1epss 0.01
PESCMS Team 2.2.1 has multiple reflected XSS via the keyword parameter: g=Team&m=User&a=index&keyword=, g=Team&m=User_group&a=index&keyword=, g=Team&m=Department&a=index&keyword=, and g=Team&m=Bulletin&a=index&keyword=.
- risk 0.40cvss 6.1epss 0.02
An issue was discovered in the Source Integration plugin before 1.5.9 and 2.x before 2.1.5 for MantisBT. A cross-site scripting (XSS) vulnerability in the Manage Repository and Changesets List pages allows execution of arbitrary code (if CSP settings permit it) via…
- risk 0.40cvss 6.1epss 0.01
WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic form[statcode] parameter.
- risk 0.40cvss 6.1epss 0.01
WUZHI CMS 4.1.0 has XSS via the index.php?m=link&f=index&v=add form[remark] parameter.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Gleez CMS v1.2.0. There is XSS via media/imagecache/resize.
- risk 0.40cvss 6.1epss 0.01
Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.
- risk 0.40cvss 6.1epss 0.01
There is XSS in GetSimple CMS 3.4.0.9 via the admin/edit.php title field.
- risk 0.40cvss 6.1epss 0.01
In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field.
- risk 0.40cvss 6.1epss 0.01
Bludit 2.3.4 allows XSS via a user name.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request.
- risk 0.40cvss 6.1epss 0.01
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering.
- risk 0.40cvss 6.1epss 0.01
MorningStar WhatWeb 0.4.9 has XSS via JSON report files.