Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (47,118)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-25276 1Drupal 1Drupal Jun 17, 2026 Apr 26, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scr...Show more The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.Show less
CVE-2023-30267 1Cltphp 1Cltphp Jun 17, 2026 Apr 26, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 CLTPHP <=6.0 is vulnerable to Cross Site Scripting (XSS) via application/home/controller/Changyan.php.
CVE-2023-2294 1Ucms Project 1Ucms Jun 17, 2026 Apr 26, 2023 N/A· v4 6.1 MEDIUM· v3 4.0 MEDIUM· v2 A vulnerability was found in UCMS 1.6.0. It has been classified as problematic. This affects an unknown part of the file saddpost.php of the component Column Configuration. The manipulation of the argument strorder leads...Show more A vulnerability was found in UCMS 1.6.0. It has been classified as problematic. This affects an unknown part of the file saddpost.php of the component Column Configuration. The manipulation of the argument strorder leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227481 was assigned to this vulnerability.Show less
CVE-2023-30111 1Medicine Tracker System Project 1Medicine Tracker System Jun 17, 2026 Apr 26, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS).
CVE-2023-30106 1Medicine Tracker System Project 1Medicine Tracker System Jun 17, 2026 Apr 26, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Sourcecodester Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS) via page=about.
CVE-2012-5873 1Arc2 Project 1Arc2 Feb 3, 2025 Apr 26, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 ARC (aka ARC2) through 2011-12-01 allows reflected XSS via the end_point.php query parameter in an output=htmltab action.
CVE-2023-31223 1Dradisframework 1Dradis Jun 17, 2026 Apr 25, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars.
CVE-2023-2293 1Purchase Order Management System Project 1Purchase Order Management System Jun 17, 2026 Apr 25, 2023 N/A· v4 4.8 MEDIUM· v3 3.3 LOW· v2 A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been classified as problematic. This affects an unknown part of the file classes/Master.php?f=save_item. The manipulation of the ar...Show more A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been classified as problematic. This affects an unknown part of the file classes/Master.php?f=save_item. The manipulation of the argument description with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227463.Show less
CVE-2023-25461 1Smartlogix 1Wp Insert Jun 17, 2026 Apr 25, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in namithjawahar Wp-Insert plugin <= 2.5.0 versions.
CVE-2023-24005 1Winwar 1Inline Tweet Sharer Jun 17, 2026 Apr 25, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media Inline Tweet Sharer – Twitter Sharing Plugin plugin <= 2.5.3 versions.
CVE-2023-23995 1Tinymce Custom Styles Project 1Tinymce Custom Styles Jun 17, 2026 Apr 25, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tim Reeves & David Stöckl TinyMCE Custom Styles plugin <= 1.1.2 versions.
CVE-2023-23889 1Fullworksplugins 1Quick Paypal Payments Jun 17, 2026 Apr 25, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.
CVE-2023-23866 1Interactive Geo Maps Project 1Interactive Geo Maps Jun 17, 2026 Apr 25, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Carlos Moreira Interactive Geo Maps plugin <= 1.5.8 versions.
CVE-2023-23710 1Miniorange 1Wordpress Social Login And Register (discord, Google, Twitter, Linkedin) Jun 17, 2026 Apr 25, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.
CVE-2023-30838 1Prestashop 1Prestashop Jun 17, 2026 Apr 25, 2023 N/A· v4 9.9 CRITICAL· v3 N/A· v2 PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the `ValidateCore::isCleanHTML()` method of Prestashop misses hijackable events which can lead to cross-site scripting (XSS) i...Show more PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the `ValidateCore::isCleanHTML()` method of Prestashop misses hijackable events which can lead to cross-site scripting (XSS) injection, allowed by the presence of pre-setup `@keyframes` methods. This XSS, which hijacks HTML attributes, can be triggered without any interaction by the visitor/administrator, which makes it as dangerous as a trivial XSS attack. Contrary to other attacks which target HTML attributes and are triggered without user interaction (such as onload / onerror which suffer from a very limited scope), this one can hijack every HTML element, which increases the danger due to a complete HTML elements scope. Versions 8.0.4 and 1.7.8.9 contain a fix for this issue.Show less
CVE-2023-25793 1Link Juice Keeper Project 1Link Juice Keeper Jun 17, 2026 Apr 25, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in George Pattihis Link Juice Keeper plugin <= 2.0.2 versions.
CVE-2023-25485 1Json Content Importer 1Json Content Importer Jun 17, 2026 Apr 25, 2023 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bernhard Kux JSON Content Importer plugin <= 1.3.15 versions.
CVE-2021-45071 1Odoo 1Odoo Jun 17, 2026 Apr 25, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, via crafted uploaded file names.
CVE-2021-44775 1Odoo 1Odoo Jun 17, 2026 Apr 25, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting craft...Show more Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.Show less
CVE-2021-44461 1Odoo 1Odoo Jun 17, 2026 Apr 25, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accounting journal entries to inject arbitrary web script in the br...Show more Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accounting journal entries to inject arbitrary web script in the browser of a victim.Show less

Previous 1...125312541255...2356 Next