Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (45,650)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-34816 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the domain parameter to /manage/smtpscan/domainrouting/. An authenticated attacker can inject arbitrary JavaScript that is stored and e...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the domain parameter to /manage/smtpscan/domainrouting/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34815 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the DOMAIN parameter to /cgi-bin/smtpdomains.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the DOMAIN parameter to /cgi-bin/smtpdomains.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34814 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the group parameter to /cgi-bin/proxygroup.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed w...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the group parameter to /cgi-bin/proxygroup.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34813 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the user parameter to /cgi-bin/proxyuser.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed whe...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the user parameter to /cgi-bin/proxyuser.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34812 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the mimetypes parameter to /cgi-bin/proxypolicy.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and execu...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the mimetypes parameter to /cgi-bin/proxypolicy.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34811 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/xtaccess.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed wh...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/xtaccess.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34810 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/vpnfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/vpnfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34809 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/zonefw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/zonefw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34808 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/outgoingfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/outgoingfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34807 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/incoming.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed wh...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/incoming.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34806 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/snat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when o...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/snat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34805 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/dnat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when o...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/dnat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34804 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the dscp parameter to /manage/qos/rules/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when ot...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the dscp parameter to /manage/qos/rules/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34803 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the name parameter to /manage/qos/classes/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the name parameter to /manage/qos/classes/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34802 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark user ham spam parameter to /cgi-bin/salearn.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored an...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark user ham spam parameter to /cgi-bin/salearn.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34801 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dhcp/fixed_leases/. An authenticated attacker can inject arbitrary JavaScript that is stored and execut...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dhcp/fixed_leases/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34800 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the NAME parameter to /cgi-bin/uplinkeditor.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the NAME parameter to /cgi-bin/uplinkeditor.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34799 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dnsmasq/hosts/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed w...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dnsmasq/hosts/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34798 1Endian 1Firewall Community Jul 24, 2026 Apr 2, 2026 5.1 MEDIUM· v4 5.4 MEDIUM· v3 N/A· v2 Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/routing.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed whe...Show more Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/routing.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.Show less
CVE-2026-34729 1Phpmyfaq 1Phpmyfaq Jun 17, 2026 Apr 2, 2026 N/A· v4 4.8 MEDIUM· v3 N/A· v2 phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, there is a stored XSS vulnerability via Regex Bypass in Filter::removeAttributes(). This issue has been patched in version 4.1.1.

Previous 1...118119120...2283 Next