Improper Neutralization of Script in Attributes in a Web Page
CWE-83
The product does not neutralize or incorrectly neutralizes javascript: or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
We track 13 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.0.
How this weakness is prevented
- Implementation: With Struts, write all data from form beans with the bean's filter attribute set to true.
Latest Improper Neutralization of Script in Attributes in a Web Page vulnerabilities
- 8.2 High severity
GFI KerioConnect: Improper Neutralization of Input During Web Page Generation
GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email at
- 7.4 High severity
OCO-Server: Improper Neutralization of Script in Attributes in a Web Page
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in `lib/Html.class.php` embeds an action URL containing a stored computer hostname in
- 7.6 High severity
tinacms: Improper Neutralization of Input During Web Page Generation
Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author c
- 8.2 High severity
file-viewer: Improper Neutralization of Input During Web Page Generation
File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into g
- 9.3 Critical severity
mybb: Improper Neutralization of Script in Attributes in a Web Page
MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the fro
- 8.3 High severity
Trilium: Improper Neutralization of Input During Web Page Generation
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class at
- 7.4 High severity
kirby: Improper Neutralization of Script in Attributes in a Web Page
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any blueprint allowed a scripting link to be included as the target of a link or email link in writer mark components, making the target clickabl
- 7.2 High severity
jodit: Improper Neutralization of Input During Web Page Generation
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed by a MathML/<style> carrier that hides a dangerous element from the sanitizer's element walk, so a no-
- 7.1 High severity
Customer Engagement & Loyalty Platform: Improper Neutralization of Input During Web Page Generation
Stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement & Loyalty Platform allows an authenticated attacker to execute arbitrary JavaScript code in a victim's browser. The vulnerability is due to improper sanitizati
- 7.2 High severity
Cloud NGFW: Improper Neutralization of Script in Attributes in a Web Page
An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and execute arbitrary commands. The security risk posed by this issue
- 9.0 Critical severity
business-links: Improper Neutralization of Input During Web Page Generation
The Volkov Labs Business Links panel for Grafana provides an interface to navigate using external links, internal dashboards, time pickers, and dropdown menus. Prior to version 2.4.0, a malicious actor with Editor privileges can escalate their privileges to Ad
- 7.8 High severity
Firefox for iOS: Improper Neutralization of Script in Attributes in a Web Page
An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. This vulnerability affects Firefox for iOS < 123.
- 9.6 Critical severity
xwiki-rendering: Improper Neutralization of Input During Web Page Generation
XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML rendering, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-sit