← Back
CWE-79

46,771 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (46,771)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-2727
1Atisoluciones
1Ciges
Jun 17, 2026
Mar 22, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
HTML injection vulnerability affecting the CIGESv2 system, which allows an attacker to inject arbitrary code and modify elements of the website and email confirmation message.
CVE-2024-2726
1Atisoluciones
1Ciges
Jun 17, 2026
Mar 22, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Stored Cross-Site Scripting (Stored-XSS) vulnerability affecting the CIGESv2 system, allowing an attacker to execute and store malicious javascript code in the application form without prior registration.
CVE-2024-29273
1Dzzoffice
1Dzzoffice
Jun 17, 2026
Mar 22, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document.
CVE-2024-29271
1Vvveb
1Vvvebjs
Jun 17, 2026
Mar 22, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute arbitrary code and obtain sensitive information via the action parameter in save.php.
CVE-2024-26557
1Codiad
1Codiad
Jun 17, 2026
Mar 22, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Codiad v2.8.4 allows reflected XSS via the components/market/dialog.php type parameter.
CVE-2024-25807
1Lycheeorg
1Lychee
Jun 17, 2026
Mar 22, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album.
CVE-2024-2780
1Campcodes
1Online Marriage Registration System
Jun 17, 2026
Mar 22, 2024
N/A· v4
6.1 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability was found in Campcodes Online Marriage Registration System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/admin-profile.php. The manipulation of the a...Show more
A vulnerability was found in Campcodes Online Marriage Registration System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/admin-profile.php. The manipulation of the argument adminname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257614 is the identifier assigned to this vulnerability.Show less
CVE-2024-2500
-
-
Jun 17, 2026
Mar 22, 2024
N/A· v4
6.4 MEDIUM· v3
N/A· v2
The ColorMag theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes i...Show more
The ColorMag theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authentciated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less
CVE-2024-2392
1Creativethemes
1Blocksy Companion
Jun 17, 2026
Mar 22, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions up to, and including, 2.0.31 due to insufficient input sanitization and output es...Show more
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions up to, and including, 2.0.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less
CVE-2024-0957
1Webtoffee
1Woocommerce Pdf Invoices, Packing Slips, Delivery Notes And Shipping Labels
Jun 17, 2026
Mar 22, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Customer Notes field in all versions up to, and including, 4.4.1 d...Show more
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Customer Notes field in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected invoice for printing.Show less
CVE-2024-2779
1Campcodes
1Online Marriage Registration System
Jun 17, 2026
Mar 22, 2024
N/A· v4
5.4 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability was found in Campcodes Online Marriage Registration System 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/application-bwdates-reports-details.php. The manipula...Show more
A vulnerability was found in Campcodes Online Marriage Registration System 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/application-bwdates-reports-details.php. The manipulation of the argument fromdate leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257613 was assigned to this vulnerability.Show less
CVE-2024-2778
1Campcodes
1Online Marriage Registration System
Jun 17, 2026
Mar 22, 2024
N/A· v4
6.1 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability was found in Campcodes Online Marriage Registration System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/search.php. The manipulation of the ar...Show more
A vulnerability was found in Campcodes Online Marriage Registration System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/search.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257612.Show less
CVE-2024-2775
1Campcodes
1Online Marriage Registration System
Jun 17, 2026
Mar 21, 2024
N/A· v4
6.1 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability, which was classified as problematic, has been found in Campcodes Online Marriage Registration System 1.0. This issue affects some unknown processing of the file /user/user-profile.php. The manipulation o...Show more
A vulnerability, which was classified as problematic, has been found in Campcodes Online Marriage Registration System 1.0. This issue affects some unknown processing of the file /user/user-profile.php. The manipulation of the argument lname leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257609 was assigned to this vulnerability.Show less
CVE-2024-2773
1Campcodes
1Online Marriage Registration System
Jun 17, 2026
Mar 21, 2024
N/A· v4
6.1 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability classified as problematic has been found in Campcodes Online Marriage Registration System 1.0. This affects an unknown part of the file /user/search.php. The manipulation of the argument searchdata leads...Show more
A vulnerability classified as problematic has been found in Campcodes Online Marriage Registration System 1.0. This affects an unknown part of the file /user/search.php. The manipulation of the argument searchdata leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257607.Show less
CVE-2024-28045
1Deltaww
1Diaenergie
Jun 17, 2026
Mar 21, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Improper neutralization of input within the affected product could lead to cross-site scripting.
CVE-2024-29374
1Moodle
1Moodle
Jun 17, 2026
Mar 21, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.
CVE-2024-2580
-
-
Jun 17, 2026
Mar 21, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Automation By Autonami allows Stored XSS.This issue affects Automation By Autonami: from n/a through 2.8.2.
CVE-2024-2579
-
-
Jun 17, 2026
Mar 21, 2024
N/A· v4
5.9 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Tracking Code Manager.This issue affects Tracking Code Manager: from n/a through 2.0.16.
CVE-2024-2578
1Wow Company
1Wp Coder
Jun 17, 2026
Mar 21, 2024
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCoder WP Coder allows Stored XSS.This issue affects WP Coder: from n/a through 3.5.
CVE-2024-27965
1Getwpfunnels
1Wpfunnels
Jun 17, 2026
Mar 21, 2024
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.This issue affects WPFunnels: from n/a through <= 3.0.6.