Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (46,951)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-38214 1Adobe 1Experience Manager Jun 17, 2026 Sep 13, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager versions 6.5.17 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable...Show more Adobe Experience Manager versions 6.5.17 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.Show less
CVE-2023-29183 1Fortinet 2Fortios Fortiproxy Jun 17, 2026 Sep 13, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 and FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11...Show more An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 and FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14 GUI may allow an authenticated attacker to trigger malicious JavaScript code execution via crafted guest management setting.Show less
CVE-2023-29306 1Adobe 1Connect Jun 17, 2026 Sep 13, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Adobe Connect versions 12.3 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript...Show more Adobe Connect versions 12.3 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.Show less
CVE-2023-29305 1Adobe 1Connect Jun 17, 2026 Sep 13, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Adobe Connect versions 12.3 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript...Show more Adobe Connect versions 12.3 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.Show less
CVE-2023-41423 1Terryl 1Wp Githuber Md Jun 17, 2026 Sep 12, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability in WP Githuber MD plugin v.1.16.2 allows a remote attacker to execute arbitrary code via a crafted payload to the new article function.
CVE-2023-39208 1Zoom 1Zoom Jun 17, 2026 Sep 12, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Improper input validation in Zoom Desktop Client for Linux before version 5.15.10 may allow an unauthenticated user to conduct a denial of service via network access.
CVE-2023-21523 1Blackberry 1Athoc Jun 17, 2026 Sep 12, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A Stored Cross-site Scripting (XSS) vulnerability in the Management Console (User Management and Alerts) of BlackBerry AtHoc version 7.15 could allow an attacker to execute script commands in the c...Show more A Stored Cross-site Scripting (XSS) vulnerability in the Management Console (User Management and Alerts) of BlackBerry AtHoc version 7.15 could allow an attacker to execute script commands in the context of the affected user account. Show less
CVE-2023-30962 1Palantir 1Gotham Cerberus Jun 17, 2026 Sep 12, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Gotham to launch attacks against other users. This vulnerability is resol...Show more The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Gotham to launch attacks against other users. This vulnerability is resolved in Cerberus 100.230704.0-27-g031dd58 .Show less
CVE-2023-21522 1Blackberry 1Athoc Jun 17, 2026 Sep 12, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A Reflected Cross-site Scripting (XSS) vulnerability in the Management Console (Reports) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially control a script that is executed in the victim's browser...Show more A Reflected Cross-site Scripting (XSS) vulnerability in the Management Console (Reports) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially control a script that is executed in the victim's browser then they can execute script commands in the context of the affected user account. Show less
CVE-2023-38164 1Microsoft 1Dynamics 365 Jun 17, 2026 Sep 12, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-36886 1Microsoft 1Dynamics 365 Jun 17, 2026 Sep 12, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-36800 1Microsoft 1Dynamics 365 Jun 17, 2026 Sep 12, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Dynamics Finance and Operations Cross-site Scripting Vulnerability
CVE-2023-0119 1Redhat 1Satellite Jun 17, 2026 Sep 12, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A stored Cross-site scripting vulnerability was found in foreman. The Comment section in the Hosts tab has incorrect filtering of user input data. As a result of the attack, an attacker with an existing account on the sy...Show more A stored Cross-site scripting vulnerability was found in foreman. The Comment section in the Hosts tab has incorrect filtering of user input data. As a result of the attack, an attacker with an existing account on the system can steal another user's session, make requests on behalf of the user, and obtain user credentials.Show less
CVE-2023-4913 1Cecil 1Cecil Jun 17, 2026 Sep 12, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - Reflected in GitHub repository cecilapp/cecil prior to 7.47.1.
CVE-2023-41013 1Icewarp 1Icewarp Jul 9, 2026 Sep 12, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross Site Scripting (XSS) in Webmail Calendar in IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.
CVE-2023-37875 1Wftpserver 1Wing Ftp Server Jun 17, 2026 Sep 12, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Improper encoding or escaping of output in Wing FTP Server (User Web Client) allows Cross-Site Scripting (XSS).This issue affects Wing FTP Server: <= 7.2.0.
CVE-2023-40624 1Sap 1Netweaver Application Server Abap Jun 17, 2026 Sep 12, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 SAP NetWeaver AS ABAP (applications based on Unified Rendering) - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702, SAP_BASIS 731, allows an attacker to inject JavaScript code that can b...Show more SAP NetWeaver AS ABAP (applications based on Unified Rendering) - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702, SAP_BASIS 731, allows an attacker to inject JavaScript code that can be executed in the web-application. An attacker could thereby control the behavior of this web-application. Show less
CVE-2023-4890 1Designchemical 1Jquery Accordion Menu Widget Jun 17, 2026 Sep 12, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The JQuery Accordion Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcwp-jquery-accordion' shortcode in versions up to, and including, 3.1.2 due to insufficient input sanitization and...Show more The JQuery Accordion Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcwp-jquery-accordion' shortcode in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less
CVE-2023-4887 1Themeisle 1Google Maps Plugin By Intergeo Jun 17, 2026 Sep 12, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The Google Maps Plugin by Intergeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'intergeo' shortcode in versions up to, and including, 2.3.2 due to insufficient input sanitization and output esca...Show more The Google Maps Plugin by Intergeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'intergeo' shortcode in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less
CVE-2023-4840 1Mappresspro 1Mappress Jun 17, 2026 Sep 12, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mappress' shortcode in versions up to, and including, 2.88.4 due to insufficient input sanitization and output escapi...Show more The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mappress' shortcode in versions up to, and including, 2.88.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less

Previous 1...115511561157...2348 Next