Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (47,050)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-22685 1Tipsandtricks Hq 1Category Specific Rss Feed Subscription Jun 17, 2026 May 12, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.2 versions.
CVE-2022-48020 1Vinteo 1Video Core Jun 17, 2026 May 12, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Vinteo VCC v2.36.4 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the conference parameter. This vulnerability allows attackers to inject arbitrary code which will be executed by the v...Show more Vinteo VCC v2.36.4 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the conference parameter. This vulnerability allows attackers to inject arbitrary code which will be executed by the victim user's browser.Show less
CVE-2023-23867 1Buttons X Project 1Buttons X Jun 17, 2026 May 12, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gautam Thapar Button Builder – Buttons X plugin <= 0.8.6 versions.
CVE-2023-29983 1Companymaps Project 1Companymaps Jun 17, 2026 May 12, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability found in Maximilian Vogt cmaps v.8.0 allows a remote attacker to execute arbitrary code via the auditlog tab in the admin panel.
CVE-2023-27237 1Lavalite 1Lavalite Jul 9, 2026 May 12, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.
CVE-2023-2678 1File Tracker Manager System Project 1File Tracker Manager System Jun 17, 2026 May 12, 2023 N/A· v4 5.4 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability has been found in SourceCodester File Tracker Manager System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /file_manager/admin/save_user.php of the component POST...Show more A vulnerability has been found in SourceCodester File Tracker Manager System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /file_manager/admin/save_user.php of the component POST Parameter Handler. The manipulation of the argument firstname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228892.Show less
CVE-2023-2671 1Oretnom23 1Lost And Found Information System Jun 17, 2026 May 12, 2023 N/A· v4 6.1 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file classes/Master.php?f=save_inquiry of the compone...Show more A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file classes/Master.php?f=save_inquiry of the component Contact Form. The manipulation of the argument fullname/contact/message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228887.Show less
CVE-2023-2667 1Oretnom23 1Lost And Found Information System Jun 17, 2026 May 12, 2023 N/A· v4 6.1 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability has been found in SourceCodester Lost and Found Information System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/. The manipulation of the...Show more A vulnerability has been found in SourceCodester Lost and Found Information System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/. The manipulation of the argument page leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228883.Show less
CVE-2023-28520 1Ibm 1Planning Analytics Local Jun 17, 2026 May 12, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 IBM Planning Analytics Local 2.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...Show more IBM Planning Analytics Local 2.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 250454.Show less
CVE-2023-29808 1Companymaps Project 1Companymaps Jun 17, 2026 May 12, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross Site Scripting (XSS) vulnerability in vogtmh cmaps (companymaps) 8.0 allows attackers to execute arbitrary code.
CVE-2021-39036 1Ibm 1Cognos Analytics Jun 17, 2026 May 12, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to c...Show more IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213966.Show less
CVE-2023-28358 1Rocketchat 1Rocket.chat Jun 17, 2026 May 11, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature allows the insertion of malicious tags. This can be exploited on servers with content security policy dis...Show more A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature allows the insertion of malicious tags. This can be exploited on servers with content security policy disabled possible leading to some issues attacks like account takeover.Show less
CVE-2023-29791 1Kodcloud 1Kodbox Jun 17, 2026 May 11, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 kodbox <= 1.37 is vulnerable to Cross Site Scripting (XSS) via the debug information.
CVE-2023-30394 1Moveit 1Moveit Jun 17, 2026 May 11, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The MoveIt framework 1.1.11 for ROS allows cross-site scripting (XSS) via the API authentication function. NOTE: this issue is disputed by the original reporter because it has "no impact."
CVE-2023-29031 1Rockwellautomation 2Armorstart St 281e Firmware Armorstart St 284ee Firmware Jun 17, 2026 May 11, 2023 N/A· v4 7.1 HIGH· v3 N/A· v2 A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user to view and modify sensitive data or make the web page unavailable. User i...Show more A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user to view and modify sensitive data or make the web page unavailable. User interaction, such as a phishing attack, is required for successful exploitation of this vulnerability. Show less
CVE-2023-29030 1Rockwellautomation 2Armorstart St 281e Firmware Armorstart St 284ee Firmware Jun 17, 2026 May 11, 2023 N/A· v4 7.1 HIGH· v3 N/A· v2 A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user to view and modify sensitive data or make the web page unavailable. User i...Show more A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user to view and modify sensitive data or make the web page unavailable. User interaction, such as a phishing attack, is required for successful exploitation of this vulnerability. Show less
CVE-2023-29029 1Rockwellautomation 2Armorstart St 281e Firmware Armorstart St 284ee Firmware Jun 17, 2026 May 11, 2023 N/A· v4 5.9 MEDIUM· v3 N/A· v2 A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify th...Show more A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page. Show less
CVE-2023-29028 1Rockwellautomation 2Armorstart St 281e Firmware Armorstart St 284ee Firmware Jun 17, 2026 May 11, 2023 N/A· v4 5.9 MEDIUM· v3 N/A· v2 A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify th...Show more A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page. Show less
CVE-2023-29027 1Rockwellautomation 2Armorstart St 281e Firmware Armorstart St 284ee Firmware Jun 17, 2026 May 11, 2023 N/A· v4 5.9 MEDIUM· v3 N/A· v2 A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify th...Show more A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page. Show less
CVE-2023-29026 1Rockwellautomation 2Armorstart St 281e Firmware Armorstart St 284ee Firmware Jun 17, 2026 May 11, 2023 N/A· v4 5.9 MEDIUM· v3 N/A· v2 A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify th...Show more A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause interruptions to the availability of the web page. Show less

Previous 1...123412351236...2353 Next