← Back
CWE-79

46,571 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (46,571)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-8328
1Easy Test Online Learning And Testing Platform Project
1Easy Test Online Learning And Testing Platform
Jun 17, 2026
Aug 30, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Easy test Online Learning and Testing Platform from HWA JIUH DIGITAL TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with regular privilege to inject arbitrary JavaScript code a...Show more
Easy test Online Learning and Testing Platform from HWA JIUH DIGITAL TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with regular privilege to inject arbitrary JavaScript code and perform Reflected Cross-site scripting attacks.Show less
CVE-2024-41349
1Unmark
1Unmark
Jun 17, 2026
Aug 29, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
unmark 1.9.2 is vulnerable to Cross Site Scripting (XSS) via application/views/marks/add_by_url.php.
CVE-2024-41371
1Organizr
1Organizr
Jun 17, 2026
Aug 29, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Organizr v1.90 is vulnerable to Cross Site Scripting (XSS) via api.php.
CVE-2024-41358
1Phpipam
1Phpipam
Jun 17, 2026
Aug 29, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php.
CVE-2024-41351
1Baijunyao
1Bjyadmin
Jun 17, 2026
Aug 29, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/getContent.php
CVE-2024-41350
1Baijunyao
1Bjyadmin
Jun 17, 2026
Aug 29, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/imageUp.php
CVE-2024-41348
1Jpatokal
1Openflights
Jun 17, 2026
Aug 29, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/alsearch.php
CVE-2024-41347
1Jpatokal
1Openflights
Jun 17, 2026
Aug 29, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/settings.php
CVE-2024-41346
1Jpatokal
1Openflights
Jun 17, 2026
Aug 29, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/submit.php
CVE-2024-41345
1Jpatokal
1Openflights
Jun 17, 2026
Aug 29, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/trip.php
CVE-2024-43921
1Magic Post Thumbnail
1Magic Post Thumbnail
Jun 17, 2026
Aug 29, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Magic Post Thumbnail allows Reflected XSS.This issue affects Magic Post Thumbnail: from n/a through 5.2.9.
CVE-2024-43920
1Jegstudio
1Gutenverse
Jun 17, 2026
Aug 29, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jegstudio Gutenverse allows Stored XSS.This issue affects Gutenverse: from n/a through 1.9.4.
CVE-2024-44930
1Serilog Contrib
1Serilog Enrichers Clientinfo
Jun 17, 2026
Aug 29, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Serilog before v2.1.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP as a value of X-Forwarded-For or Client-Ip headers wh...Show more
Serilog before v2.1.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP as a value of X-Forwarded-For or Client-Ip headers while performing HTTP requests.Show less
CVE-2024-44779
1Vtiger
1Vtiger Crm
Jul 5, 2026
Aug 29, 2024
N/A· v4
9.6 CRITICAL· v3
N/A· v2
A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted p...Show more
A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.Show less
CVE-2024-44778
1Vtiger
1Vtiger Crm
Jul 5, 2026
Aug 29, 2024
N/A· v4
9.6 CRITICAL· v3
N/A· v2
A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted pay...Show more
A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.Show less
CVE-2024-44777
1Vtiger
1Vtiger Crm
Jul 5, 2026
Aug 29, 2024
N/A· v4
9.6 CRITICAL· v3
N/A· v2
A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payloa...Show more
A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.Show less
CVE-2024-44717
1Dedebiz
1Dedebiz
Jun 17, 2026
Aug 29, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2024-44716
1Dedebiz
1Dedebiz
Jun 17, 2026
Aug 29, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2024-43964
1Dsgvo For Wp
1Dsgvo All In One For Wp
Jun 17, 2026
Aug 29, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Michael Leithold DSGVO All in one for WP allows Stored XSS.This issue affects DSGVO All in one for WP: from n/a...Show more
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Michael Leithold DSGVO All in one for WP allows Stored XSS.This issue affects DSGVO All in one for WP: from n/a through 4.5.Show less
CVE-2024-43963
1Waspthemes
1Yellowpencil
Jun 17, 2026
Aug 29, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WaspThemes YellowPencil Visual CSS Style Editor allows Reflected XSS.This issue affects YellowPencil Visual CSS...Show more
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WaspThemes YellowPencil Visual CSS Style Editor allows Reflected XSS.This issue affects YellowPencil Visual CSS Style Editor: from n/a through 7.6.1.Show less