Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (46,977)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-32497 1Supersoju 1Block Referer Spam Jun 17, 2026 Aug 23, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Supersoju Block Referer Spam plugin <= 1.1.9.4 versions.
CVE-2023-32496 1Stopbadbots 1Block Bad Bots And Stop Bad Bots Crawlers And Spiders And Anti Spam Protection Jun 17, 2026 Aug 23, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bill Minozzi Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin <= 7.31 versions.
CVE-2023-32236 1Bookingultrapro 1Appointments Booking Calendar Jun 17, 2026 Aug 23, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Booking Ultra Pro Booking Ultra Pro Appointments Booking Calendar Plugin <= 1.1.8 versions.
CVE-2023-32119 1Wpo365 1Mail Integration For Office 365 / Outlook Jun 17, 2026 Aug 23, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPO365 \| Mail Integration for Office 365 / Outlook plugin <= 1.9.0 versions.
CVE-2023-41098 2Misp Misp Project 2Misp Misp Jun 22, 2026 Aug 23, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 An issue was discovered in MISP 2.4.174. In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon a dashboard edit.
CVE-2023-39599 1Cszcms 1Csz Cms Jun 17, 2026 Aug 22, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross-Site Scripting (XSS) vulnerability in CSZ CMS v.1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Social Settings parameter.
CVE-2023-37439 1Arubanetworks 1Edgeconnect Sd Wan Orchestrator Jun 17, 2026 Aug 22, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator...Show more Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host. Show less
CVE-2023-37425 1Arubanetworks 1Edgeconnect Sd Wan Orchestrator Jun 17, 2026 Aug 22, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user...Show more A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.Show less
CVE-2023-37423 1Arubanetworks 1Edgeconnect Sd Wan Orchestrator Jun 17, 2026 Aug 22, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user o...Show more Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.Show less
CVE-2023-37422 1Arubanetworks 1Edgeconnect Sd Wan Orchestrator Jun 17, 2026 Aug 22, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user o...Show more Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.Show less
CVE-2023-37421 1Arubanetworks 1Edgeconnect Sd Wan Orchestrator Jun 17, 2026 Aug 22, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user o...Show more Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.Show less
CVE-2023-24516 1Pandorafms 1Pandora Fms Jun 17, 2026 Aug 22, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin users easily with little user interaction. This issue affects Pa...Show more Cross-site Scripting (XSS) vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin users easily with little user interaction. This issue affects Pandora FMS v767 version and prior versions on all platforms.Show less
CVE-2023-24514 1Pandorafms 1Pandora Fms Jun 17, 2026 Aug 22, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing attacks, etc. This issue affects Pandora FMS v767 version and...Show more Cross-site Scripting (XSS) vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing attacks, etc. This issue affects Pandora FMS v767 version and prior versions on all platforms.Show less
CVE-2022-48547 1Cacti 1Cacti Jun 17, 2026 Aug 22, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A reflected cross-site scripting (XSS) vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the "ref" parameter at auth_changepassword.php.
CVE-2022-41444 1Cacti 1Cacti Jun 17, 2026 Aug 22, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross Site Scripting (XSS) vulnerability in Cacti 1.2.21 via crafted POST request to graphs_new.php.
CVE-2020-23992 1Nagios 1Nagios Xi Jun 17, 2026 Aug 22, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross Site Scripting (XSS) in Nagios XI 5.7.1 allows remote attackers to run arbitrary code via returnUrl parameter in a crafted GET request.
CVE-2020-22181 1Samsung 1Sww 3400rw Firmware Jun 17, 2026 Aug 22, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A reflected cross site scripting (XSS) vulnerability was discovered on Samsung sww-3400rw Router devices via the m2 parameter of the sess-bin/command.cgi
CVE-2023-4303 1Jenkins 1Fortify Jun 17, 2026 Aug 21, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method, resulting in an HTML injection vulnerability.
CVE-2023-3954 1Multiparcels 1Multiparcels Shipping For Woocommerce Jun 17, 2026 Aug 21, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used aga...Show more The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as adminShow less
CVE-2023-39094 1Zerowdd 1Studentmanager Jun 17, 2026 Aug 21, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability in ZeroWdd studentmanager v.1.0 allows a remote attacker to execute arbitrary code via the username parameter in the student list function.

Previous 1...117011711172...2349 Next