Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (47,080)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-23789 1Premmerce 1Premmerce Redirect Manager Jun 17, 2026 May 10, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Premmerce Premmerce Redirect Manager plugin <= 1.0.9 versions.
CVE-2023-23788 1Custom More Link Complete Project 1Custom More Link Complete Jun 17, 2026 May 10, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Florin Arjocu Custom More Link Complete plugin <= 1.4.1 versions.
CVE-2023-23786 1Servit 1Affiliate Toolkit Jun 17, 2026 May 10, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Christof Servit affiliate-toolkit plugin <= 3.3.3 versions.
CVE-2023-23701 1Web Design Easy Sign Up Project 1Web Design Easy Sign Up Jun 17, 2026 May 10, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Andrew @ Geeenville Web Design Easy Sign Up plugin <= 3.4.1 versions.
CVE-2023-22711 1Agentevolution 1Impress Listings Jun 17, 2026 May 10, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Agent Evolution IMPress Listings plugin <= 2.6.2 versions.
CVE-2023-30777 1Advancedcustomfields 1Advanced Custom Fields Jun 17, 2026 May 10, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.
CVE-2023-2615 1Pimcore 1Pimcore Jun 17, 2026 May 10, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-2614 1Pimcore 1Pimcore Jun 17, 2026 May 10, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-27918 1Tms Outsource 1Amelia Jun 17, 2026 May 10, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated attacker to inject an arbitrary script by having a user who is...Show more Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated attacker to inject an arbitrary script by having a user who is logging in the WordPress where the product is installed visit a malicious URL.Show less
CVE-2023-27888 1Sitebridge 1Joruri Gw Jun 17, 2026 May 10, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross-site scripting vulnerability in Joruri Gw Ver 3.2.5 and earlier allows a remote authenticated attacker to inject an arbitrary script via Message Memo function of the affected product.
CVE-2023-2616 1Pimcore 1Pimcore Jun 17, 2026 May 10, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-25833 1Esri 1Portal For Arcgis Jun 17, 2026 May 10, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the vi...Show more There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser (no stateful change made or customer data rendered).Show less
CVE-2023-30057 1Fico 1Origination Manager Decision Jul 9, 2026 May 9, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Multiple stored cross-site scripting (XSS) vulnerabilities in FICO Origination Manager Decision Module 4.8.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2023-25831 1Esri 1Portal For Arcgis Jun 17, 2026 May 9, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary...Show more There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.Show less
CVE-2023-25830 1Esri 1Portal For Arcgis Jun 17, 2026 May 9, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and before which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrar...Show more There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and before which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.Show less
CVE-2023-32071 1Xwiki 1Xwiki Jun 17, 2026 May 9, 2023 N/A· v4 9.0 CRITICAL· v3 N/A· v2 XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a spe...Show more XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. The easiest possible workaround is to edit file `<xwiki app>/templates/importinline.vm` and apply the modification described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01.Show less
CVE-2023-32066 1Anuko 1Time Tracker Jun 17, 2026 May 9, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logge...Show more Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements of JavaScript. Such script could then be executed in user browser on subsequent requests to week view. This issue is fixed in version 1.22.12.5783. As a workaround, use `htmlspecialchars` when calling `$field->setTitle` on line #245 in the `week.php` file, as happens in version 1.22.12.5783.Show less
CVE-2023-31807 1Chamilo 1Chamilo Lms Jul 9, 2026 May 9, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the personal notes function.
CVE-2023-31806 1Chamilo 1Chamilo Lms Jul 9, 2026 May 9, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress function.
CVE-2023-31805 1Chamilo 1Chamilo Lms Jul 9, 2026 May 9, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the homepage function.

Previous 1...123912401241...2354 Next