← Back
CWE-79

47,011 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (47,011)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-33986
1Sap
1Customer Relationship Management Abap
Jun 17, 2026
Jun 13, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
SAP CRM ABAP (Grantor Management) - versions 700, 701, 702, 712, 713, 714, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an att...Show more
SAP CRM ABAP (Grantor Management) - versions 700, 701, 702, 712, 713, 714, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application. Show less
CVE-2023-33985
1Sap
1Netweaver
Jun 17, 2026
Jun 13, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the a...Show more
SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application. Show less
CVE-2023-33984
1Sap
1Netweaver
Jun 17, 2026
Jun 13, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker to create a file with a malicious content and send a link to a...Show more
SAP NetWeaver (Design Time Repository) - version 7.50, returns an unfavorable content type for some versioned files, which could allow an authorized attacker to create a file with a malicious content and send a link to a victim in an email or instant message. Under certain circumstances, this could lead to Cross-Site Scripting vulnerability. Show less
CVE-2023-34941
1Asus
1Rt N10lx Firmware
Jun 17, 2026
Jun 12, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
A stored cross-site scripting (XSS) vulnerability in the urlFilterList function of Asus RT-N10LX Router v2.0.0.39 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL Keyw...Show more
A stored cross-site scripting (XSS) vulnerability in the urlFilterList function of Asus RT-N10LX Router v2.0.0.39 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL Keyword List text field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.Show less
CVE-2023-2718
1Codepeople
1Contact Form Email
Jun 17, 2026
Jun 12, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
The Contact Form Email WordPress plugin before 1.3.38 does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability.
CVE-2023-35054
1Jetbrains
1Youtrack
Jun 17, 2026
Jun 12, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible
CVE-2023-34026
1This Day In History Project
1This Day In History
Jun 17, 2026
Jun 12, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in BrokenCrust This Day In History plugin <= 3.10.1 versions.
CVE-2023-29385
2Kevonadonis
Wp Abstracts Project
2Wp Abstracts
Wp Abstracts
Jun 17, 2026
Jun 12, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kevon Adonis WP Abstracts plugin <= 2.6.2 versions.
CVE-2023-28933
1Stpetedesign
1Call Now Accessibility Button
Jun 17, 2026
Jun 12, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in StPeteDesign Call Now Accessibility Button plugin <= 1.1 versions.
CVE-2023-32961
1Zotpress Project
1Zotpress
Jun 17, 2026
Jun 12, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Katie Seaborn Zotpress plugin <= 7.3.3 versions.
CVE-2023-32118
1Wpoperation
1Salert Fake Sales Notification Woocommerce
Jun 17, 2026
Jun 12, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPoperation SALERT – Fake Sales Notification WooCommerce plugin <= 1.2.1 versions.
CVE-2023-31236
1Unfocus
1Scripts N Styles
Jun 17, 2026
Jun 12, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in unFocus Projects Scripts n Styles plugin <= 3.5.7 versions.
CVE-2023-30753
1Ip Metaboxes Project
1Ip Metaboxes
Jun 17, 2026
Jun 12, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Phan Chuong IP Metaboxes plugin <= 2.1.1.
CVE-2023-30745
1Ip Metaboxes Project
1Ip Metaboxes
Jun 17, 2026
Jun 12, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Phan Chuong IP Metaboxes plugin <= 2.1.1 versions.
CVE-2023-23822
1Utm Tracker Project
1Utm Tracker
Jun 17, 2026
Jun 12, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ludwig Media UTM Tracker plugin <= 1.3.1 versions.
CVE-2023-23819
1Itemprop Wp For Serp/seo Rich Snippets Project
1Itemprop Wp For Serp/seo Rich Snippets
Jun 17, 2026
Jun 12, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Rolands Umbrovskis itemprop WP for SERP/SEO Rich snippets plugin <= 3.5.201706131 versions.
CVE-2023-34855
1Ac Centralized Management Platform Project
1Ac Centralized Management Platform
Jun 17, 2026
Jun 12, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
A Cross Site Scripting (XSS) vulnerability in Youxun Electronic Equipment (Shanghai) Co., Ltd AC Centralized Management Platform v1.02.040 allows attackers to execute arbitrary code via uploading a crafted HTML file to t...Show more
A Cross Site Scripting (XSS) vulnerability in Youxun Electronic Equipment (Shanghai) Co., Ltd AC Centralized Management Platform v1.02.040 allows attackers to execute arbitrary code via uploading a crafted HTML file to the interface /upfile.cgi.Show less
CVE-2023-33492
1Eyoucms
1Eyoucms
Jun 17, 2026
Jun 12, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
EyouCMS 1.6.2 is vulnerable to Cross Site Scripting (XSS).
CVE-2023-23818
1Aviplugins
1Wp Register Profile With Shortcode
Jun 17, 2026
Jun 12, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Aviplugins.Com WP Register Profile With Shortcode plugin <= 3.5.7 versions.
CVE-2022-47140
1Reputeinfosystems
1Armember
Jun 17, 2026
Jun 12, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember plugin <= 4.0.1 versions.