CWE-79
MITRE ↗Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
In JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possible
In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possible
In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible
In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible
In JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possible
Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance
In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible
PyBB is an open source bulletin board. A manual code review of the PyBB bulletin board server has revealed that a vulner
IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScr
In JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possible
In JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possible
In JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possible
In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads
IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbit
In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible
Azure HDInsight Jupyter Notebook Spoofing Vulnerability
In JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configuration
In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step
IBM Security Guardium 11.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav
jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs coul
Cross-Site Scripting (XSS) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to inj
IBM FileNet Content Manager 5.5.8, 5.5.10, and 5.5.11 is vulnerable to cross-site scripting. This vulnerability allows u
IBM Content Navigator 3.0.11, 3.0.13, and 3.0.14 with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting. T
A cross-site scripting (XSS) vulnerability has been reported to affect Video Station. If exploited, the vulnerability co
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21
Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation
Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation
Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description
IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to t
Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations.
Control By Web X-400 devices are vulnerable to a cross-site scripting attack, which could result in private and session
Azure Apache Ambari Spoofing Vulnerability
GLPI is a free asset and IT management software package. Starting in version 0.60 and prior to versions 9.5.13 and 10.0.
Azure Apache Hive Spoofing Vulnerability
Azure Apache Oozie Spoofing Vulnerability
Azure Apache Ambari Spoofing Vulnerability
Azure Apache Hadoop Spoofing Vulnerability
The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters
The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in ver
The Solidres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'currency_name' parameter in vers
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings
Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 o
The Sp*tify Play Button for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settin
The Maps Widget for Google Maps for WordPress is vulnerable to Stored Cross-Site Scripting via widget settings in versio
A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all v
Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements und
The Blog-in-Blog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blog_in_blog' shortcode in v
The CRM Perks Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in versions up t
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions star
Frequently Asked Questions
What is CWE-79?
CWE-79 (Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)) is a weakness category in the Common Weakness Enumeration (CWE) system maintained by MITRE. It describes a class of software or hardware vulnerability that can lead to security issues.
How many CVEs are classified as CWE-79?
There are 53,037 CVE records associated with CWE-79 in our database. Of these, 560 are critical severity, 4909 are high severity, and 31199 are medium severity.
How can I protect against CWE-79 vulnerabilities?
Protection strategies depend on the specific weakness type. General measures include input validation, secure coding practices, regular security testing, and keeping software up to date. CyberStrike can help by automatically scanning your infrastructure for vulnerabilities related to CWE-79 using AI-powered security agents.
Detect CWE-79 Vulnerabilities
CyberStrike's AI agents automatically detect improper neutralization of input during web page generation (cross-site scripting) vulnerabilities across your infrastructure.
Get Started