CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

base

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

übergeordnete Schwächen

Übergeordnete Klassen, zu denen dies gehört.

CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

untergeordnete Schwächen

Spezifischere Einträge unterhalb dieses.

Schwachstellen (52910)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-42897US	medium6.1OT kritisch	0.52% (43rd)	KEV	2026-05-14
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network…
CVE-2025-66376US	medium6.1OT kritisch	20.2% (97th)	KEV	2026-01-05
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.
CVE-2025-68461US	medium6.1OT kritisch	26.8% (98th)	KEV	2025-12-18
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
CVE-2025-48700US	—OT kritisch	1.71% (77th)	KEV	2025-06-23
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to exec…
CVE-2025-27915US	—OT kritisch	4.06% (91st)	KEV	2025-03-12
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient…
CVE-2024-44309US	medium6.3OT kritisch	22.6% (98th)	KEV	2024-11-20
A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequ…
CVE-2024-44308US	high8.8OT kritisch	10.2% (96th)	KEV	2024-11-20
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1…
CVE-2024-11182US	medium6.1OT kritisch	31.4% (98th)	KEV	2024-11-15
An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remot…
CVE-2024-43573US	high8.1OT kritisch	46.1% (99th)	KEV	2024-10-08
Windows MSHTML Platform Spoofing Vulnerability
CVE-2024-27443US	medium6.1OT kritisch	24.6% (98th)	KEV	2024-08-12
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic us…
CVE-2024-42009US	critical9.3OT kritisch	82.9% (100th)	KEV	2024-08-05
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message t…
CVE-2024-37383US	medium6.1OT kritisch	73.3% (99th)	KEV	2024-06-07
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
CVE-2023-5631US	medium5.4OT kritisch	76.9% (100th)	KEV	2023-10-18
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_…
CVE-2023-43770US	medium6.1OT kritisch	63.7% (99th)	KEV	2023-09-22
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_repla…
CVE-2023-37580US	medium6.1OT kritisch	49.1% (99th)	KEV	2023-07-31
Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
CVE-2023-34192US	critical9.0OT kritisch	77.3% (100th)	KEV	2023-07-06
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.
CVE-2022-39197US	medium6.1OT kritisch	46.4% (99th)	KEV	2022-09-22
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To ex…
CVE-2022-27926US	medium6.1OT kritisch	17.6% (97th)	KEV	2022-04-21
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute…
CVE-2022-24682US	medium6.1OT kritisch	30.9% (98th)	KEV	2022-02-09
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attack…
CVE-2021-20035US	medium6.5OT kritisch	4.41% (91st)	KEV	2021-09-27
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentia…

Angriffsmuster (6)

CAPEC-Angriffsmuster, die dies ausnutzen.

Quelle

Wo diese Definition veröffentlicht ist.

MITREUS

scry

Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan