← Back
CWE-79

46,770 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (46,770)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-31634
1Xunruicms
1Xunruicms
Jun 17, 2026
Apr 16, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross Site Scripting (XSS) vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbitrary code via the Security.php file in the catalog \XunRuiCMS\dayrui\Fcms\Library.
CVE-2024-3575
1Mindsdb
1Mindsdb
Jun 17, 2026
Apr 16, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb
CVE-2024-27794
1Claris
1Filemaker Server
Jun 17, 2026
Apr 15, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Claris FileMaker Server before version 20.3.2 was susceptible to a reflected Cross-Site Scripting vulnerability due to an improperly handled parameter in the FileMaker WebDirect login endpoint. The vulnerability was reso...Show more
Claris FileMaker Server before version 20.3.2 was susceptible to a reflected Cross-Site Scripting vulnerability due to an improperly handled parameter in the FileMaker WebDirect login endpoint. The vulnerability was resolved in FileMaker Server 20.3.2 by escaping the HTML contents of the login error message on the login page.Show less
CVE-2020-22540
1Codologic
1Codoforum
Jun 17, 2026
Apr 15, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Stored Cross-Site Scripting (XSS) vulnerability in Codoforum v4.9, allows attackers to execute arbitrary code and obtain sensitive information via crafted payload to Category name component.
CVE-2024-31651
1Oretnom23
1Cosmetics And Beauty Product Online Store
Jun 17, 2026
Apr 15, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the First Name parameter.
CVE-2024-31652
1Oretnom23
1Cosmetics And Beauty Product Online Store
Jun 17, 2026
Apr 15, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter.
CVE-2024-31650
1Oretnom23
1Cosmetics And Beauty Product Online Store
Jun 17, 2026
Apr 15, 2024
N/A· v4
9.6 CRITICAL· v3
N/A· v2
A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Last Name parameter.
CVE-2024-31649
1Oretnom23
1Cosmetics And Beauty Product Online Store
Jun 17, 2026
Apr 15, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter.
CVE-2023-47626
1Combodo
1Itop
Jun 17, 2026
Apr 15, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
iTop is an IT service management platform. When displaying/editing the user's personal tokens, XSS attacks are possible. This vulnerability is fixed in 3.1.1.
CVE-2023-47622
1Combodo
1Itop
Jun 17, 2026
Apr 15, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
iTop is an IT service management platform. When dashlet are refreshed, XSS attacks are possible. This vulnerability is fixed in 3.0.4 and 3.1.1.
CVE-2023-47123
1Combodo
1Itop
Jun 17, 2026
Apr 15, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another obje...Show more
iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another object. This vulnerability is fixed in 3.1.1 and 3.2.0.Show less
CVE-2023-44396
1Combodo
1Itop
Jun 17, 2026
Apr 15, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1.
CVE-2023-43790
1Combodo
1Itop
Jun 17, 2026
Apr 15, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value. This vulnerability is fixed in 3.1.1 and 3.2.0.
CVE-2024-32453
1Poeditor
1Poeditor
Jun 17, 2026
Apr 15, 2024
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POEditor allows Stored XSS.This issue affects POEditor: from n/a through 0.9.8.
CVE-2024-32429
1Wpchill
1Remove Footer Credit
Jun 17, 2026
Apr 15, 2024
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPChill Remove Footer Credit allows Stored XSS.This issue affects Remove Footer Credit: from n/a through 1.0.13.
CVE-2024-32428
1Mosswebworks
1Mww Disclaimer Buttons
Jun 17, 2026
Apr 15, 2024
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moss Web Works MWW Disclaimer Buttons allows Stored XSS.This issue affects MWW Disclaimer Buttons: from n/a through 3....Show more
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moss Web Works MWW Disclaimer Buttons allows Stored XSS.This issue affects MWW Disclaimer Buttons: from n/a through 3.0.2.Show less
CVE-2024-32149
1Blueglass
1Jobs For Wordpress
Jun 17, 2026
Apr 15, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Jobs for WordPress allows Reflected XSS.This issue affects Jobs for WordPress: from n/a through 2.7.5.
CVE-2024-32147
1Ghozylab
1Contact Form
Jun 17, 2026
Apr 15, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Form Plugin Team - GhozyLab Easy Contact Form Lite allows Stored XSS.This issue affects Easy Contact Form Lite : from...Show more
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Form Plugin Team - GhozyLab Easy Contact Form Lite allows Stored XSS.This issue affects Easy Contact Form Lite : from n/a through 1.1.23.Show less
CVE-2024-32145
1Wpgoaltracker
1Wp Google Analytics Events
Jun 17, 2026
Apr 15, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PineWise WP Google Analytics Events allows Reflected XSS.This issue affects WP Google Analytics Events: from n/a throu...Show more
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PineWise WP Google Analytics Events allows Reflected XSS.This issue affects WP Google Analytics Events: from n/a through 2.8.0.Show less
CVE-2024-32140
1Libsyn
1Libsyn Publisher Hub
Jun 17, 2026
Apr 15, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in libsyn Libsyn Publisher Hub libsyn-podcasting.This issue affects Libsyn Publisher Hub: from n/a through <= 1.4.4.