CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

base

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

parent weaknesses

Broader classes this is a kind of.

CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

child weaknesses

More specific entries beneath this one.

vulnerabilities (52910)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-42897US	medium6.1OT critical	0.52% (43rd)	KEV	2026-05-14
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network…
CVE-2025-66376US	medium6.1OT critical	20.2% (97th)	KEV	2026-01-05
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.
CVE-2025-68461US	medium6.1OT critical	26.8% (98th)	KEV	2025-12-18
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
CVE-2025-48700US	—OT critical	1.71% (77th)	KEV	2025-06-23
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to exec…
CVE-2025-27915US	—OT critical	4.06% (91st)	KEV	2025-03-12
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient…
CVE-2024-44309US	medium6.3OT critical	22.6% (98th)	KEV	2024-11-20
A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequ…
CVE-2024-44308US	high8.8OT critical	10.2% (96th)	KEV	2024-11-20
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1…
CVE-2024-11182US	medium6.1OT critical	31.4% (98th)	KEV	2024-11-15
An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remot…
CVE-2024-43573US	high8.1OT critical	46.1% (99th)	KEV	2024-10-08
Windows MSHTML Platform Spoofing Vulnerability
CVE-2024-27443US	medium6.1OT critical	24.6% (98th)	KEV	2024-08-12
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic us…
CVE-2024-42009US	critical9.3OT critical	82.9% (100th)	KEV	2024-08-05
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message t…
CVE-2024-37383US	medium6.1OT critical	73.3% (99th)	KEV	2024-06-07
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
CVE-2023-5631US	medium5.4OT critical	76.9% (100th)	KEV	2023-10-18
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_…
CVE-2023-43770US	medium6.1OT critical	63.7% (99th)	KEV	2023-09-22
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_repla…
CVE-2023-37580US	medium6.1OT critical	49.1% (99th)	KEV	2023-07-31
Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
CVE-2023-34192US	critical9.0OT critical	77.3% (100th)	KEV	2023-07-06
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.
CVE-2022-39197US	medium6.1OT critical	46.4% (99th)	KEV	2022-09-22
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To ex…
CVE-2022-27926US	medium6.1OT critical	17.6% (97th)	KEV	2022-04-21
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute…
CVE-2022-24682US	medium6.1OT critical	30.9% (98th)	KEV	2022-02-09
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attack…
CVE-2021-20035US	medium6.5OT critical	4.41% (91st)	KEV	2021-09-27
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentia…

attack patterns (6)

CAPEC attack patterns that exploit this.

source

Where this definition is published.

MITREUS

scry

Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.

Free scan