← Back
CWE-79

46,885 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (46,885)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-47175
1Luxsoft
1Luxcal Web Calendar
Jun 17, 2026
Nov 20, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script o...Show more
Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the product.Show less
CVE-2023-40817
1Opencrx
1Opencrx
Jun 17, 2026
Nov 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field.
CVE-2023-40816
1Opencrx
1Opencrx
Jun 17, 2026
Nov 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field.
CVE-2023-40815
1Opencrx
1Opencrx
Jun 17, 2026
Nov 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field.
CVE-2023-40814
1Opencrx
1Opencrx
Jun 17, 2026
Nov 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field.
CVE-2023-40813
1Opencrx
1Opencrx
Jun 17, 2026
Nov 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation.
CVE-2023-40812
1Opencrx
1Opencrx
Jun 17, 2026
Nov 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field.
CVE-2023-40810
1Opencrx
1Opencrx
Jun 17, 2026
Nov 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field.
CVE-2023-40809
1Opencrx
1Opencrx
Jun 17, 2026
Nov 18, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number.
CVE-2023-44796
1Limesurvey
1Limesurvey
Jun 17, 2026
Nov 18, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a crafted script to the _generaloptions_panel.php component.
CVE-2023-48295
1Librenms
1Librenms
Jun 17, 2026
Nov 17, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Affected versions are subject to a cross site scripting (XSS) vul...Show more
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Affected versions are subject to a cross site scripting (XSS) vulnerability in the device group popups. This issue has been addressed in commit `faf66035ea` which has been included in release version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.Show less
CVE-2023-44352
1Adobe
1Coldfusion
Jun 17, 2026
Nov 17, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL re...Show more
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.Show less
CVE-2020-11448
1Bell
1Home Hub 3000 Firmware
Jun 17, 2026
Nov 17, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
An issue was discovered on Bell HomeHub 3000 SG48222070 devices. There is XSS related to the email field and the login page.
CVE-2023-47797
1Liferay
1Liferay Portal
Jun 17, 2026
Nov 17, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject arbitrary web script or HTML via the `p_l_back_url_title` par...Show more
Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject arbitrary web script or HTML via the `p_l_back_url_title` parameter.Show less
CVE-2023-48649
1Concretecms
1Concrete Cms
Jun 17, 2026
Nov 17, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows stored XSS on the Admin page via an uploaded file name.
CVE-2023-40314
1Opennms
2Horizon
Meridian
Jun 17, 2026
Nov 16, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Horizon 32.0.5 or newer and Merid...Show more
Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Horizon 32.0.5 or newer and Meridian 2023.1.9 or newer Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Moshe Apelbaum for reporting this issue. Show less
CVE-2023-46213
1Splunk
2Cloud
Splunk
Jun 17, 2026
Nov 16, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized code in a user’s web browser.
CVE-2023-39926
1Acurax
1Under Construction / Maintenance Mode
Jun 17, 2026
Nov 16, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Acurax Under Construction / Maintenance Mode from Acurax plugin <= 2.6 versions.
CVE-2023-34375
110web
1Seo
Jun 17, 2026
Nov 16, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web SEO by 10Web plugin <= 1.2.9 versions.
CVE-2023-32957
1Dazzlersoft
1Team Members Showcase
Jun 17, 2026
Nov 16, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dazzlersoft Team Members Showcase plugin <= 1.3.4 versions.