Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (46,989)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-36869 1Microsoft 1Azure Devops Server Aug 10, 2026 Aug 8, 2023 N/A· v4 6.3 MEDIUM· v3 N/A· v2 Azure DevOps Server Spoofing Vulnerability
CVE-2023-35394 1Microsoft 2Azure Hdinsight Azure Hdinsights Aug 10, 2026 Aug 8, 2023 N/A· v4 4.6 MEDIUM· v3 N/A· v2 Azure HDInsight Jupyter Notebook Spoofing Vulnerability
CVE-2023-35393 1Microsoft 2Azure Hdinsight Azure Hdinsights Aug 10, 2026 Aug 8, 2023 N/A· v4 4.5 MEDIUM· v3 N/A· v2 Azure Apache Hive Spoofing Vulnerability
CVE-2023-38766 1Churchcrm 1Churchcrm Jun 17, 2026 Aug 8, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the PersonView.php component.
CVE-2023-38761 1Churchcrm 1Churchcrm Jun 17, 2026 Aug 8, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the systemSettings.php component.
CVE-2023-38758 1Wger 1Workout Manager Jun 17, 2026 Aug 8, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the license_author field in the add-ingredient function in the templates/ingredients/view....Show more Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the license_author field in the add-ingredient function in the templates/ingredients/view.html, models/ingredients.py, and views/ingredients.py components.Show less
CVE-2023-3653 1Digital Ant 1Digital Ant Jun 17, 2026 Aug 8, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital Ant E-Commerce Software allows Stored XSS. This issue affects E-Commerce Software: before 11.
CVE-2023-3652 1Digital Ant 1Digital Ant Jun 17, 2026 Aug 8, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital Ant E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: before 11.
CVE-2023-36306 1Adiscon 1Loganalyzer Jun 17, 2026 Aug 8, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A Cross Site Scripting (XSS) vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php, details.php, index.php, search.php, export.php, reports...Show more A Cross Site Scripting (XSS) vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php, details.php, index.php, search.php, export.php, reports.php, and statistics.php components.Show less
CVE-2023-38384 1Syntacticsinc 1Easync Jun 17, 2026 Aug 8, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Syntactics, Inc. EaSYNC plugin <= 1.3.7 versions.
CVE-2023-32292 1Getbutton 1Chat Button Jun 17, 2026 Aug 8, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GetButton Chat Button by GetButton.Io plugin <= 1.8.9.4 versions.
CVE-2023-31221 1Ransomchristofferson 1Pdq Csv Jun 17, 2026 Aug 8, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ransom Christofferson PDQ CSV plugin <= 1.0.0 versions.
CVE-2023-30482 1Villatheme 1Wpbulky Jun 17, 2026 Aug 8, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in VillaTheme WPBulky plugin <= 1.0.10 versions.
CVE-2023-28934 1Paymentsplugin 1Wp Full Stripe Free Jun 17, 2026 Aug 8, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology WP Full Stripe Free plugin <= 1.6.1 versions.
CVE-2023-28931 1Never5 1Post Connector Jun 17, 2026 Aug 8, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Never5 Post Connector plugin <= 1.0.9 versions.
CVE-2023-28773 1Kolja Nolte 1Secondary Title Jun 17, 2026 Aug 8, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kolja Nolte Secondary Title plugin <= 2.0.9.1 versions.
CVE-2023-25984 1Rigorous Digital 1Dovetail Jun 17, 2026 Aug 8, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Rigorous & Factory Pattern Dovetail plugin <= 1.2.13 versions.
CVE-2023-37690 1Phpgurukul 1Maid Hiring Management System Jul 9, 2026 Aug 8, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Search Maid page.
CVE-2023-37689 1Phpgurukul 1Maid Hiring Management System Jul 9, 2026 Aug 8, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Booking Request page.
CVE-2023-37688 1Phpgurukul 1Maid Hiring Management System Jul 9, 2026 Aug 8, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Maid Hiring Management System v1.0 was discovered to contain a SQL injection vulnerability in the Admin page.

Previous 1...117911801181...2350 Next