Skip to main content

Over 150 LLM Providers · Over 5,300 Models The most extensible AI-powered pentesting platform. Open source. Star on GitHub

CWE-79

MITRE ↗

Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)

560
CRITICAL
4,909
HIGH
31,199
MEDIUM
2,399
LOW
39,637 CVEs · Page 476/793
5.4
CVE-2023-0995

Cross-site Scripting (XSS) - Stored in GitHub repository unilogies/bumsys prior to v2.0.1.

 5.4
CVE-2023-22425

Stored cross-site scripting vulnerability in Schedule function of SHIRASAGI v1.16.2 and earlier versions allows a remote

 5.4
CVE-2023-1067

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.

 5.4
CVE-2023-22860

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21

 5.4
CVE-2022-4788

The Embed PDF WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before output

 5.4
CVE-2023-0539

The GS Insever Portfolio WordPress plugin before 1.4.5 does not validate and escape some of its shortcode attributes bef

 5.4
CVE-2023-23157

A stored cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to exec

 5.4
CVE-2023-23158

A stored cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to exec

 5.4
CVE-2023-24251

WangEditor v5 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /dist/index.js.

 5.4
CVE-2023-24651

Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name

 5.4
CVE-2023-27294

Improper neutralization of input during web page generation allows an authenticated attacker with access to a restricted

 5.4
CVE-2023-26608

SOLDR (System of Orchestration, Lifecycle control, Detection and Response) 1.1.0 allows stored XSS via the module editor

 5.4
CVE-2023-1104

Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.

 5.4
CVE-2023-1115

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.

 5.4
CVE-2023-1116

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.

 5.4
CVE-2023-1117

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.

 5.4
CVE-2023-1107

Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.

 5.4
CVE-2023-1146

Cross-site Scripting (XSS) - Generic in GitHub repository flatpressblog/flatpress prior to 1.3.

 5.4
CVE-2023-1147

Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.

 5.4
CVE-2021-45479

Improper Neutralization of Input During Web Page Generation vulnerability in Yordam Information Technologies Library Aut

 5.4
CVE-2023-20069

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Netwo

 5.4
CVE-2023-26491

RSSHub is an open source and extensible RSS feed generator. When the URL parameters contain certain special characters,

5.4
CVE-2023-1181

Cross-site Scripting (XSS) - Stored in GitHub repository icret/easyimages2.0 prior to 2.6.7.

 5.4
CVE-2023-22438

Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0

5.4
CVE-2023-22838

Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUB

 5.4
CVE-2023-25077

Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p

 5.4
CVE-2022-44875

KioWare through 8.33 on Windows sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin, which allows at

 5.4
CVE-2023-0063

The WordPress Shortcodes WordPress plugin through 1.6.36 does not validate and escape some of its shortcode attributes b

 5.4
CVE-2023-0064

The eVision Responsive Column Layout Shortcodes WordPress plugin through 2.3 does not validate and escape some of its sh

 5.4
CVE-2023-0065

The i2 Pros & Cons WordPress plugin through 1.3.1 does not validate and escape some of its shortcode attributes before o

 5.4
CVE-2023-0068

The Product GTIN (EAN, UPC, ISBN) for WooCommerce WordPress plugin through 1.1.1 does not validate and escape some of it

 5.4
CVE-2023-0165

The Cost Calculator WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before ou

 5.4
CVE-2023-0212

The Advanced Recent Posts WordPress plugin through 0.6.14 does not validate and escape some of its shortcode attributes

5.4
CVE-2023-0377

The Scriptless Social Sharing WordPress plugin before 3.2.2 does not validate and escape some of its block options befor

 5.4
CVE-2021-36398

In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS ris

 5.4
CVE-2021-36399

In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk

 5.4
CVE-2022-42248

QlikView 12.60.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the QvsViewClient functi

 5.4
CVE-2023-1237

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

 5.4
CVE-2023-1238

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

 5.4
CVE-2023-1240

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

 5.4
CVE-2023-1241

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

 5.4
CVE-2023-1242

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

 5.4
CVE-2023-1244

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

 5.4
CVE-2023-1245

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.

 5.4
CVE-2023-26954

onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Group module

 5.4
CVE-2023-26955

onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Admin Group modul

 5.4
CVE-2023-26950

onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Title parameter u

 5.4
CVE-2023-1270

Cross-site Scripting in GitHub repository btcpayserver/btcpayserver prior to 1.8.3.

 5.4
CVE-2023-26952

onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Menu module.

 5.4
CVE-2023-24282

An arbitrary file upload vulnerability in Poly Trio 8800 7.2.2.1094 allows attackers to execute arbitrary code via a cra

Frequently Asked Questions

What is CWE-79?

CWE-79 (Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)) is a weakness category in the Common Weakness Enumeration (CWE) system maintained by MITRE. It describes a class of software or hardware vulnerability that can lead to security issues.

How many CVEs are classified as CWE-79?

There are 53,037 CVE records associated with CWE-79 in our database. Of these, 560 are critical severity, 4909 are high severity, and 31199 are medium severity.

How can I protect against CWE-79 vulnerabilities?

Protection strategies depend on the specific weakness type. General measures include input validation, secure coding practices, regular security testing, and keeping software up to date. CyberStrike can help by automatically scanning your infrastructure for vulnerabilities related to CWE-79 using AI-powered security agents.

Detect CWE-79 Vulnerabilities

CyberStrike's AI agents automatically detect improper neutralization of input during web page generation (cross-site scripting) vulnerabilities across your infrastructure.

Get Started