← Back
CWE-79

46,516 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (46,516)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-9030
1Workdo
1Crmgo Saas
Jun 17, 2026
Sep 20, 2024
5.3 MEDIUM· v4
5.4 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability classified as problematic was found in CodeCanyon CRMGo SaaS 7.2. This vulnerability affects unknown code of the file /deal/{note_id}/note. The manipulation of the argument notes leads to cross site scrip...Show more
A vulnerability classified as problematic was found in CodeCanyon CRMGo SaaS 7.2. This vulnerability affects unknown code of the file /deal/{note_id}/note. The manipulation of the argument notes leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.Show less
CVE-2024-9007
1Jeanmarc77
1123solar
Jun 17, 2026
Sep 19, 2024
5.3 MEDIUM· v4
5.4 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability classified as problematic has been found in jeanmarc77 123solar 1.8.4.5. This affects an unknown part of the file /detailed.php. The manipulation of the argument date1 leads to cross site scripting. It is...Show more
A vulnerability classified as problematic has been found in jeanmarc77 123solar 1.8.4.5. This affects an unknown part of the file /detailed.php. The manipulation of the argument date1 leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 94bf9ab7ad0ccb7fbdc02f172f37f0e2ea08d48f. It is recommended to apply a patch to fix this issue.Show less
CVE-2024-38221
1Microsoft
1Edge Chromium
Aug 10, 2026
Sep 19, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-8653
1Netcat
1Netcat Content Management System
Jun 17, 2026
Sep 19, 2024
5.9 MEDIUM· v4
6.1 MEDIUM· v3
N/A· v2
A vulnerability in NetCat CMS allows an attacker to execute JavaScript code in a user's browser when they visit specific paths on the site. This issue affects NetCat CMS v. 6.4.0.24126.2 and possibly others. Apply patch...Show more
A vulnerability in NetCat CMS allows an attacker to execute JavaScript code in a user's browser when they visit specific paths on the site. This issue affects NetCat CMS v. 6.4.0.24126.2 and possibly others. Apply patch from vendor https://netcat.ru/ https://netcat.ru/] . Versions 6.4.0.24248 and on have the patch.Show less
CVE-2024-8652
1Netcat
1Netcat Content Management System
Jun 17, 2026
Sep 19, 2024
5.9 MEDIUM· v4
6.1 MEDIUM· v3
N/A· v2
A vulnerability in NetCat CMS allows an attacker to execute JavaScript code in a user's browser when they visit specific path on the site. This issue affects NetCat CMS v. 6.4.0.24126.2 and possibly others. Apply patch...Show more
A vulnerability in NetCat CMS allows an attacker to execute JavaScript code in a user's browser when they visit specific path on the site. This issue affects NetCat CMS v. 6.4.0.24126.2 and possibly others. Apply patch from vendor https://netcat.ru/ https://netcat.ru/] . Versions 6.4.0.24248 and on have the patch.Show less
CVE-2024-7737
-
-
Jun 17, 2026
Sep 19, 2024
N/A· v4
8.7 HIGH· v3
N/A· v2
A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser se...Show more
A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.Show less
CVE-2024-7736
13ds
13dexperience Enovia
Jun 17, 2026
Sep 19, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script c...Show more
A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.Show less
CVE-2024-7785
-
-
Jun 17, 2026
Sep 19, 2024
9.3 CRITICAL· v4
N/A· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ece Software Electronic Ticket System allows Reflected XSS, Cross-Site Scripting (XSS). This issue affects Ele...Show more
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ece Software Electronic Ticket System allows Reflected XSS, Cross-Site Scripting (XSS). This issue affects Electronic Ticket System: before 2024.08.Show less
CVE-2024-8850
1Ibericode
1Mailchimp
Jun 17, 2026
Sep 19, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email' parameter when a placeholder such as {email} is used for the field in versions 4.9.9 to 4.9.16 due t...Show more
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email' parameter when a placeholder such as {email} is used for the field in versions 4.9.9 to 4.9.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.Show less
CVE-2024-8364
1Webhammer
1Wp Custom Fields Search
Jun 17, 2026
Sep 19, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
The WP Custom Fields Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcfs-preset shortcode in all versions up to, and including, 1.2.35 due to insufficient input sanitization an...Show more
The WP Custom Fields Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcfs-preset shortcode in all versions up to, and including, 1.2.35 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less
CVE-2021-27917
1Acquia
1Mautic
Jun 17, 2026
Sep 18, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.
CVE-2024-47058
1Acquia
1Mautic
Jun 17, 2026
Sep 18, 2024
N/A· v4
4.8 MEDIUM· v3
N/A· v2
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.
CVE-2024-47050
1Acquia
1Mautic
Jun 17, 2026
Sep 18, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.
CVE-2024-46372
1Dedecms
1Dedecms
Jun 17, 2026
Sep 18, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
DedeCMS 5.7.115 is vulnerable to Cross Site Scripting (XSS) via the advertisement code box in the advertisement management module.
CVE-2024-43025
1Rws
1Multitrans
Jun 17, 2026
Sep 18, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
An HTML injection vulnerability in RWS MultiTrans v7.0.23324.2 and earlier allows attackers to alter the HTML-layout and possibly execute a phishing attack via a crafted payload injected into a sent e-mail.
CVE-2024-43024
1Rws
1Multitrans
Jun 17, 2026
Sep 18, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Multiple stored cross-site scripting (XSS) vulnerabilities in RWS MultiTrans v7.0.23324.2 and earlier allow attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2024-6877
1Elizsoftware
1Panel
Jun 17, 2026
Sep 18, 2024
9.4 CRITICAL· v4
6.1 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Reflected XSS. This issue affects Panel: before v2.3.24.
CVE-2024-5959
1Elizsoftware
1Panel
Jun 17, 2026
Sep 18, 2024
9.3 CRITICAL· v4
5.4 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Stored XSS. This issue affects Panel: before v2.3.24.
CVE-2022-25774
1Acquia
1Mautic
Jun 17, 2026
Sep 18, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Prior to the patched version, logged in users of Mautic are vulnerable to a self XSS vulnerability in the notifications within Mautic. Users could inject malicious code into the notification when saving Dashboards.
CVE-2024-45366
1Welcart
1Welcart E Commerce
Jun 17, 2026
Sep 18, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Welcart e-Commerce prior to 2.11.2 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the user's web browser.