Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (46,984)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-27524 1Margox 1Braft Editor Jun 17, 2026 Aug 11, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross Site Scripting (XSS) vulnerability in margox braft-editor version 2.3.8, allows remote attackers to execute arbitrary code via the embed media feature.
CVE-2020-28849 1Churchcrm 1Churchcrm Jun 17, 2026 Aug 11, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross Site Scripting (XSS) vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive information via crafted payload in Add New Deposit field in View All Deposit module...Show more Cross Site Scripting (XSS) vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive information via crafted payload in Add New Deposit field in View All Deposit module.Show less
CVE-2020-28717 1Kindsoft 1Kindeditor Jun 17, 2026 Aug 11, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross Site Scripting (XSS) vulnerability in content1 parameter in demo.jsp in kindsoft kindeditor version 4.1.12, allows attackers to execute arbitrary code.
CVE-2020-27449 1Zohocorp 1Manageengine Password Manager Pro Jun 17, 2026 Aug 11, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross Site Scripting (XSS) vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute arbitrary code and steal cookies via crafted JavaScript payload...Show more Cross Site Scripting (XSS) vulnerability in Query Report feature in Zoho ManageEngine Password Manager Pro version 11001, allows remote attackers to execute arbitrary code and steal cookies via crafted JavaScript payload.Show less
CVE-2020-25915 1Thinkcmf 1Thinkcmf Jun 17, 2026 Aug 11, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted user_login.
CVE-2020-24872 1Lepton Cms 1Leptoncms Jun 17, 2026 Aug 11, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross Site Scripting (XSS) vulnerability in backend/pages/modify.php in Lepton-CMS version 4.7.0, allows remote attackers to execute arbitrary code.
CVE-2020-24075 1Laborator 1Kalium Jun 17, 2026 Aug 11, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross Site Scripting (XSS) vulnerability in Name Input Field in Contact Us form in Laborator Kalium before 3.0.4, allows remote attackers to execute arbitrary code.
CVE-2020-20523 1Gilacms 1Gila Cms Jun 17, 2026 Aug 11, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross Site Scripting (XSS) vulnerability in adm_user parameter in Gila CMS version 1.11.3, allows remote attackers to execute arbitrary code during the Gila CMS installation.
CVE-2020-19952 1Jbt 1Live (github Flavored) Markdown Editor Jun 17, 2026 Aug 11, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross Site Scripting (XSS) vulnerability in Rendering Engine in jbt Markdown Editor thru commit 2252418c27dffbb35147acd8ed324822b8919477, allows remote attackers to execute arbirary code via crafted payload or opening ma...Show more Cross Site Scripting (XSS) vulnerability in Rendering Engine in jbt Markdown Editor thru commit 2252418c27dffbb35147acd8ed324822b8919477, allows remote attackers to execute arbirary code via crafted payload or opening malicious .md file.Show less
CVE-2023-3937 1Snowsoftware 1Snow License Manager Jun 17, 2026 Aug 11, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows allows an authenticated user with high privileges to trigger cross site scripting...Show more Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows allows an authenticated user with high privileges to trigger cross site scripting attack via the web browserShow less
CVE-2023-27515 1Intel 1Driver & Support Assistant Jun 17, 2026 Aug 11, 2023 N/A· v4 9.6 CRITICAL· v3 N/A· v2 Cross-site scripting (XSS) for the Intel(R) DSA software before version 23.1.9 may allow unauthenticated user to potentially enable escalation of privilege via network access.
CVE-2022-29887 1Intel 1Manageability Commander Jun 17, 2026 Aug 11, 2023 N/A· v4 9.6 CRITICAL· v3 N/A· v2 Cross-site Scripting (XSS) in some Intel(R) Manageability Commander software before version 2.3 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVE-2023-38333 1Zohocorp 1Manageengine Applications Manager Jun 17, 2026 Aug 10, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in.
CVE-2023-40224 2Misp Misp Project 2Misp Misp Jun 22, 2026 Aug 10, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 MISP 2.4.174 allows XSS in app/View/Events/index.ctp.
CVE-2023-37625 1Netbox 1Netbox Jun 17, 2026 Aug 10, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A stored cross-site scripting (XSS) vulnerability in Netbox v3.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Link templates.
CVE-2023-36315 1Phpjabbers 1Callback Widget Jun 17, 2026 Aug 10, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Callback Widget v1.0.
CVE-2023-36314 1Phpjabbers 1Callback Widget Jun 17, 2026 Aug 10, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 There is a Cross Site Scripting (XSS) vulnerability in the value-text-o_sms_email_request_message parameters of index.php in PHPJabbers Callback Widget v1.0.
CVE-2023-36313 1Phpjabbers 1Document Creator Jun 17, 2026 Aug 10, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting (XSS) via all post parameters of "Export Requests" aside from "request_feed".
CVE-2023-36312 1Phpjabbers 1Callback Widget Jun 17, 2026 Aug 10, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 There is a Cross Site Scripting (XSS) vulnerability in the value-enum-o_bf_include_timezone parameter of index.php in PHPJabbers Callback Widget v1.0.
CVE-2023-36310 1Phpjabbers 1Document Creator Jun 17, 2026 Aug 10, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 There is a Cross Site Scripting (XSS) vulnerability in the "column" parameter of index.php in PHPJabbers Document Creator v1.0.

Previous 1...117611771178...2350 Next