CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
variantThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (1036)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-19953US | medium6.1OT critical | KEV | ||
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4… | ||||
| CVE-2018-19943US | medium5.4OT critical | KEV | ||
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS… | ||||
| CVE-2020-13965US | medium6.1OT critical | KEV | ||
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a pre… | ||||
| CVE-2013-0431US | medium5.0OT critical | KEV | ||
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the… | ||||
| CVE-2024-4439US | medium6.1 | Exploit | ||
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the di… | ||||
| CVE-2022-36094US | critical9.0 | — | ||
XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's p… | ||||
| CVE-2022-36096US | critical9.0 | — | ||
The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6… | ||||
| CVE-2021-32607US | critical9.8 | — | ||
An issue was discovered in Smartstore (aka SmartStoreNET) through 4.1.1. Views/PrivateMessages/View.cshtml does not call HtmlUtils.SanitizeHtml on a private message. | ||||
| CVE-2020-13564US | medium6.1 | — | ||
A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker… | ||||
| CVE-2020-13563US | medium6.1 | — | ||
A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker… | ||||
| CVE-2020-13562US | medium6.1 | — | ||
A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker… | ||||
| CVE-2001-1325US | high7.5 | Exploit | ||
Internet Explorer 5.0 and 5.5, and Outlook Express 5.0 and 5.5, allow remote attackers to execute scripts when Active Scripting is disabled by including the scripts in XML styleshe… | ||||
| CVE-2022-21145US | medium4.8 | — | ||
A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can lead to arbitrar… | ||||
| CVE-2022-36097US | medium6.1 | — | ||
XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-rc-1 and prior to 14.4… | ||||
| CVE-2011-4899US | high7.5 | Exploit | ||
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote… | ||||
| CVE-2007-3101US | medium4.3 | Exploit | ||
Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6 allow remote attackers to inject arbitrary web script via th… | ||||
| CVE-2002-0902US | high7.5 | Exploit | ||
Cross-site scripting vulnerability in phpBB 2.0.0 (phpBB2) allows remote attackers to execute Javascript as other phpBB users by including a http:// and a double-quote (") in the [… | ||||
| CVE-2001-0857US | high7.5 | Exploit | ||
Cross-site scripting vulnerability in status.php3 in Imp Webmail 2.2.6 and earlier allows remote attackers to gain access to the e-mail of other users by hijacking session cookies… | ||||
| CVE-2024-39363US | medium6.1 | — | ||
A cross-site scripting (xss) vulnerability exists in the login.cgi set_lang_CountryCode() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can l… | ||||
| CVE-2024-32484US | high8.2 | — | ||
An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execut… | ||||
03
attack patterns (4)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan