← Back
CWE-79

47,118 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (47,118)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-2350
1Oretnom23
1Service Provider Management System
Jun 17, 2026
Apr 27, 2023
N/A· v4
5.4 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Users.php. The manipulation of...Show more
A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Users.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227593 was assigned to this vulnerability.Show less
CVE-2023-2349
1Oretnom23
1Service Provider Management System
Jun 17, 2026
Apr 27, 2023
N/A· v4
5.4 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability classified as problematic has been found in SourceCodester Service Provider Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument page leads...Show more
A vulnerability classified as problematic has been found in SourceCodester Service Provider Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument page leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227592.Show less
CVE-2023-30338
1Emlog
1Emlog
Jun 17, 2026
Apr 27, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Article Title or Article Summary parameters...Show more
Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Article Title or Article Summary parameters.Show less
CVE-2023-2343
1Pimcore
1Pimcore
Jun 17, 2026
Apr 27, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-2342
1Pimcore
1Pimcore
Jun 17, 2026
Apr 27, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-2341
1Pimcore
1Pimcore
Jun 17, 2026
Apr 27, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-24966
1Ibm
1Websphere Application Server
Jun 17, 2026
Apr 27, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially le...Show more
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 246904.Show less
CVE-2023-2340
1Pimcore
1Pimcore
Jun 17, 2026
Apr 27, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-2339
1Pimcore
1Pimcore
Jun 17, 2026
Apr 27, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-2328
1Pimcore
1Pimcore
Jun 17, 2026
Apr 27, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-2327
1Pimcore
1Pimcore
Jun 17, 2026
Apr 27, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-2323
1Pimcore
1Pimcore
Jun 17, 2026
Apr 27, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-2322
1Pimcore
1Pimcore
Jun 17, 2026
Apr 27, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-31285
1Serenity
2Serene
Startsharp
Jun 17, 2026
Apr 27, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
An XSS issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When users upload temporary files, some specific file endings are not allowed, but it is possible to upload .html or .htm files containing an...Show more
An XSS issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When users upload temporary files, some specific file endings are not allowed, but it is possible to upload .html or .htm files containing an XSS payload. The resulting link can be sent to an administrator user.Show less
CVE-2023-25292
1Group Office
1Group Office
Jul 9, 2026
Apr 27, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GO_LANGUAGE cookie.
CVE-2023-29442
1Zohocorp
1Manageengine Applications Manager
Jun 17, 2026
Apr 26, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS.
CVE-2023-29836
1Exelysis
1Exelysis Unified Communications Solution
Jun 17, 2026
Apr 26, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross Site Scripting vulnerability found in Exelysis Unified Communication Solutions (EUCS) v.1.0 allows a remote attacker to execute arbitrary code via the Username parameter of the eucsAdmin login form.
CVE-2023-30212
1Ourphp
1Ourphp
Jun 17, 2026
Apr 26, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.
CVE-2023-30210
1Ourphp
1Ourphp
Jun 17, 2026
Apr 26, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php.
CVE-2022-27979
1Tooljet
1Tooljet
Jul 9, 2026
Apr 26, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component.