CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,563)
page 982 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-7475 | Med | 0.40 | 6.1 | 0.01 | Jun 30, 2018 | Cross-site scripting (XSS) vulnerability for webdav/ticket/ URIs in IceWarp Mail Server 12.0.3 allows remote attackers to inject arbitrary web script or HTML. | ||
| CVE-2018-13003 | Med | 0.40 | 6.1 | 0.01 | Jun 29, 2018 | An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'type' to the /suggest URI. | ||
| CVE-2018-13001 | Med | 0.40 | 6.1 | 0.01 | Jun 29, 2018 | An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the `admin.php` file of the `./cpshop/` module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack… | ||
| CVE-2018-12996 | Med | 0.40 | 6.1 | 0.03 | Jun 29, 2018 | A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do. | ||
| CVE-2018-12973 | Med | 0.40 | 6.1 | 0.01 | Jun 29, 2018 | An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI. | ||
| CVE-2018-12919 | Med | 0.40 | 6.1 | 0.01 | Jun 27, 2018 | In CraftedWeb through 2013-09-24, aasp_includes/pages/notice.php allows XSS via the e parameter. | ||
| CVE-2018-12902 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2018 | In Easy Magazine through 2012-10-26, there is XSS in the search bar of the web site. | ||
| CVE-2018-12711 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2018 | An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. In some cases, the link of the current language might contain unescaped HTML special characters. This may lead to reflective XSS via injection of arbitrary parameters and/or… | ||
| CVE-2018-1000557 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2018 | OCS Inventory OCS Inventory NG version ocsreports 2.4 contains a Cross Site Scripting (XSS) vulnerability in login form and search functionality that can result in An attacker is able to execute arbitrary (javascript) code within a victims' browser. This attack appear to be… | ||
| CVE-2018-1000556 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2018 | WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be… | ||
| CVE-2018-1000543 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2018 | Akiee version 0.0.3 contains a XSS leading to code execution due to the use of node integration vulnerability in "Details" of a task is not validated that can result in XSS leading to abritrary code execution. This attack appear to be exploitable via The attacker tricks the… | ||
| CVE-2018-1000536 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2018 | Medis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegration for the renderer process vulnerability in Key name parameter on new key creation that can result in Unauthorized code execution in the victim's machine,… | ||
| CVE-2018-1000529 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2018 | Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS . This vulnerability appears to have been fixed in 2.2.8. | ||
| CVE-2018-1000521 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2018 | BigTree-CMS contains a Cross Site Scripting (XSS) vulnerability in /users/create that can result in The low-privileged users can use this vulnerability to attack high-privileged(Developer) users.. This attack appear to be exploitable via no. This vulnerability appears to have… | ||
| CVE-2018-1000516 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2018 | The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability in Many templates used in the Galaxy server did not properly sanitize user's input, which would allow for cross-site scripting (XSS) attacks. In… | ||
| CVE-2018-1000512 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2018 | Tooltipy Tooltipy (tooltips for WP) version 5 contains a Cross Site Scripting (XSS) vulnerability in Glossary shortcode that can result in could allow anybody to do almost anything an admin can. This attack appear to be exploitable via Admin must follow a link. This… | ||
| CVE-2018-0612 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2018 | Cross-site scripting vulnerability in 5000 trillion yen converter v1.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2018-0605 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2018 | Cross-site scripting vulnerability in Pixelpost v1.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2018-0603 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2018 | Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||
| CVE-2018-0602 | Med | 0.40 | 6.1 | 0.01 | Jun 26, 2018 | Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability for webdav/ticket/ URIs in IceWarp Mail Server 12.0.3 allows remote attackers to inject arbitrary web script or HTML.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'type' to the /suggest URI.
- risk 0.40cvss 6.1epss 0.01
An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the `admin.php` file of the `./cpshop/` module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack…
- risk 0.40cvss 6.1epss 0.03
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI.
- risk 0.40cvss 6.1epss 0.01
In CraftedWeb through 2013-09-24, aasp_includes/pages/notice.php allows XSS via the e parameter.
- risk 0.40cvss 6.1epss 0.01
In Easy Magazine through 2012-10-26, there is XSS in the search bar of the web site.
- risk 0.40cvss 6.1epss 0.01
An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. In some cases, the link of the current language might contain unescaped HTML special characters. This may lead to reflective XSS via injection of arbitrary parameters and/or…
- risk 0.40cvss 6.1epss 0.01
OCS Inventory OCS Inventory NG version ocsreports 2.4 contains a Cross Site Scripting (XSS) vulnerability in login form and search functionality that can result in An attacker is able to execute arbitrary (javascript) code within a victims' browser. This attack appear to be…
- risk 0.40cvss 6.1epss 0.01
WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be…
- risk 0.40cvss 6.1epss 0.01
Akiee version 0.0.3 contains a XSS leading to code execution due to the use of node integration vulnerability in "Details" of a task is not validated that can result in XSS leading to abritrary code execution. This attack appear to be exploitable via The attacker tricks the…
- risk 0.40cvss 6.1epss 0.01
Medis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegration for the renderer process vulnerability in Key name parameter on new key creation that can result in Unauthorized code execution in the victim's machine,…
- risk 0.40cvss 6.1epss 0.01
Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS . This vulnerability appears to have been fixed in 2.2.8.
- risk 0.40cvss 6.1epss 0.01
BigTree-CMS contains a Cross Site Scripting (XSS) vulnerability in /users/create that can result in The low-privileged users can use this vulnerability to attack high-privileged(Developer) users.. This attack appear to be exploitable via no. This vulnerability appears to have…
- risk 0.40cvss 6.1epss 0.01
The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability in Many templates used in the Galaxy server did not properly sanitize user's input, which would allow for cross-site scripting (XSS) attacks. In…
- risk 0.40cvss 6.1epss 0.01
Tooltipy Tooltipy (tooltips for WP) version 5 contains a Cross Site Scripting (XSS) vulnerability in Glossary shortcode that can result in could allow anybody to do almost anything an admin can. This attack appear to be exploitable via Admin must follow a link. This…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in 5000 trillion yen converter v1.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Pixelpost v1.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.