Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,883)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-19479 1Adobe 1Experience Manager Sep 11, 2026 Sep 8, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of...Show more Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.Show less
CVE-2025-64868 1Adobe 1Experience Manager Oct 19, 2026 Sep 8, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript ma...Show more Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.Show less
CVE-2025-64866 1Adobe 1Experience Manager Oct 19, 2026 Sep 8, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript ma...Show more Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.Show less
CVE-2025-64854 1Adobe 1Experience Manager Oct 19, 2026 Sep 8, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript ma...Show more Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.Show less
CVE-2025-64838 1Adobe 1Experience Manager Oct 19, 2026 Sep 8, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript ma...Show more Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.Show less
CVE-2025-64830 1Adobe 1Experience Manager Oct 19, 2026 Sep 8, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript ma...Show more Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.Show less
CVE-2025-64618 1Adobe 1Experience Manager Oct 19, 2026 Sep 8, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript ma...Show more Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.Show less
CVE-2025-64610 1Adobe 1Experience Manager Oct 19, 2026 Sep 8, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript ma...Show more Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.Show less
CVE-2025-64589 1Adobe 1Experience Manager Oct 19, 2026 Sep 8, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript ma...Show more Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.Show less
CVE-2025-64588 1Adobe 1Experience Manager Oct 19, 2026 Sep 8, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript ma...Show more Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.Show less
CVE-2025-64584 1Adobe 1Experience Manager Oct 19, 2026 Sep 8, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript ma...Show more Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.Show less
CVE-2025-64542 1Adobe 1Experience Manager Oct 19, 2026 Sep 8, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of...Show more Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.Show less
CVE-2026-76201 - - Sep 8, 2026 Sep 8, 2026 N/A· v4 9.3 CRITICAL· v3 N/A· v2 Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victi...Show more Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.Show less
CVE-2026-76200 - - Sep 8, 2026 Sep 8, 2026 N/A· v4 9.3 CRITICAL· v3 N/A· v2 Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victi...Show more Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.Show less
CVE-2026-69642 1Microsoft 2Skype For Business Server Skype For Business Server Subscription Edition Sep 16, 2026 Sep 8, 2026 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-63523 1Microsoft 2Skype For Business Server Skype For Business Server Subscription Edition Sep 16, 2026 Sep 8, 2026 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-81824 - - Sep 11, 2026 Sep 8, 2026 6.3 MEDIUM· v4 4.7 MEDIUM· v3 N/A· v2 The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered to click on a malicious link.
CVE-2026-69690 1Microsoft 1Sharepoint Server Sep 9, 2026 Sep 8, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-69615 1Microsoft 1Sharepoint Server Sep 10, 2026 Sep 8, 2026 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-69417 1Microsoft 1Sharepoint Server Sep 9, 2026 Sep 8, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Previous 1...105106107...2445 Next