← Back
CWE-79

47,116 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (47,116)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-2384
1Netgear
1Srx5308 Firmware
Jun 17, 2026
Apr 28, 2023
N/A· v4
4.8 MEDIUM· v3
3.3 LOW· v2
A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been declared as problematic. This vulnerability affects unknown code of the file scgi-bin/platform.cgi?page=dmz_setup.htm of the component Web Managemen...Show more
A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been declared as problematic. This vulnerability affects unknown code of the file scgi-bin/platform.cgi?page=dmz_setup.htm of the component Web Management Interface. The manipulation of the argument dhcp.SecDnsIPByte2 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227662 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2023-2383
1Netgear
1Srx5308 Firmware
Jun 17, 2026
Apr 28, 2023
N/A· v4
4.8 MEDIUM· v3
3.3 LOW· v2
A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been classified as problematic. This affects an unknown part of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Manageme...Show more
A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been classified as problematic. This affects an unknown part of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument smtpServer.fromAddr leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227661 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2023-27864
1Ibm
1Maximo Asset Management
Jun 17, 2026
Apr 28, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security co...Show more
IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 249327.Show less
CVE-2023-2382
1Netgear
1Srx5308 Firmware
Jun 17, 2026
Apr 28, 2023
N/A· v4
4.8 MEDIUM· v3
3.3 LOW· v2
A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. Affected by this issue is some unknown functionality of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the compone...Show more
A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. Affected by this issue is some unknown functionality of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument sysLogInfo.serverName leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227660. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2023-2381
1Netgear
1Srx5308 Firmware
Jun 17, 2026
Apr 28, 2023
N/A· v4
4.8 MEDIUM· v3
3.3 LOW· v2
A vulnerability has been found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file scgi-bin/platform.cgi?page=bandwidth_profile.htm of th...Show more
A vulnerability has been found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file scgi-bin/platform.cgi?page=bandwidth_profile.htm of the component Web Management Interface. The manipulation of the argument BandWidthProfile.ProfileName leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227659. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2023-30125
1Eyoucms
1Eyoucms
Jun 17, 2026
Apr 28, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
EyouCms V1.6.1-UTF8-sp1 is vulnerable to Cross Site Scripting (XSS).
CVE-2023-30123
1Wuzhicms
1Wuzhicms
Jun 17, 2026
Apr 28, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.
CVE-2023-2372
1Online Dj Management System Project
1Online Dj Management System
Jun 17, 2026
Apr 28, 2023
N/A· v4
4.8 MEDIUM· v3
3.3 LOW· v2
A vulnerability, which was classified as problematic, has been found in SourceCodester Online DJ Management System 1.0. Affected by this issue is some unknown functionality of the file classes/Master.php?f=save_event. Th...Show more
A vulnerability, which was classified as problematic, has been found in SourceCodester Online DJ Management System 1.0. Affected by this issue is some unknown functionality of the file classes/Master.php?f=save_event. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227648.Show less
CVE-2023-28820
1Concretecms
1Concrete Cms
Jun 17, 2026
Apr 28, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.
CVE-2023-28819
1Concretecms
1Concrete Cms
Jun 17, 2026
Apr 28, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names.
CVE-2023-28477
1Concretecms
1Concrete Cms
Jun 17, 2026
Apr 28, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter.
CVE-2023-28476
1Concretecms
1Concrete Cms
Jun 17, 2026
Apr 28, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files.
CVE-2023-28475
1Concretecms
1Concrete Cms
Jun 17, 2026
Apr 28, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.
CVE-2023-28474
1Concretecms
1Concrete Cms
Jun 17, 2026
Apr 28, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search.
CVE-2023-28471
1Concretecms
1Concrete Cms
Jun 17, 2026
Apr 28, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS via a container name.
CVE-2023-2364
1Resort Reservation System Project
1Resort Reservation System
Jun 17, 2026
Apr 28, 2023
N/A· v4
5.4 MEDIUM· v3
5.0 MEDIUM· v2
A vulnerability, which was classified as problematic, was found in SourceCodester Resort Reservation System 1.0. Affected is an unknown function of the file registration.php. The manipulation of the argument fullname lea...Show more
A vulnerability, which was classified as problematic, was found in SourceCodester Resort Reservation System 1.0. Affected is an unknown function of the file registration.php. The manipulation of the argument fullname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227640.Show less
CVE-2023-2361
1Pimcore
1Pimcore
Jun 17, 2026
Apr 28, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-29489
1Cpanel
1Cpanel
Jun 17, 2026
Apr 27, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.
CVE-2023-2350
1Oretnom23
1Service Provider Management System
Jun 17, 2026
Apr 27, 2023
N/A· v4
5.4 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Users.php. The manipulation of...Show more
A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Users.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227593 was assigned to this vulnerability.Show less
CVE-2023-2349
1Oretnom23
1Service Provider Management System
Jun 17, 2026
Apr 27, 2023
N/A· v4
5.4 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability classified as problematic has been found in SourceCodester Service Provider Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument page leads...Show more
A vulnerability classified as problematic has been found in SourceCodester Service Provider Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument page leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227592.Show less