← Back
CWE-79

47,142 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (47,142)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-43874
1Ibm
1App Connect Enterprise Certified Container
Jun 17, 2026
Mar 15, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
IBM App Connect Enterprise Certified Container 4.1, 4.2, 5.0, 5.1, 5.2, 6.0, 6.1, 6.2, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus...Show more
IBM App Connect Enterprise Certified Container 4.1, 4.2, 5.0, 5.1, 5.2, 6.0, 6.1, 6.2, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 239963.Show less
CVE-2023-1418
1Friendly Island Pizza Website And Ordering System Project
1Friendly Island Pizza Website And Ordering System
Jun 17, 2026
Mar 15, 2023
N/A· v4
6.1 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability classified as problematic was found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file cashconfirm.php of the c...Show more
A vulnerability classified as problematic was found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file cashconfirm.php of the component POST Parameter Handler. The manipulation of the argument transactioncode leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223129 was assigned to this vulnerability.Show less
CVE-2022-37402
1Afsanalytics
1Afs Analytics
Jun 17, 2026
Mar 15, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Stored Cross-site Scripting (XSS) vulnerability in AFS Analytics plugin <= 4.18 versions.
CVE-2022-34148
1Jetbackup
1Jetbackup
Jun 17, 2026
Mar 15, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JetBackup JetBackup – WP Backup, Migrate & Restore plugin <= 1.6.9.0 versions.
CVE-2023-0322
1Talentyazilim
1Unis
Jun 17, 2026
Mar 15, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Talent Software UNIS allows Reflected XSS. This issue affects UNIS: before 28376.
CVE-2023-24921
1Microsoft
1Dynamics 365
Jun 17, 2026
Mar 14, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-24920
1Microsoft
1Dynamics 365
Jun 17, 2026
Mar 14, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-24919
1Microsoft
1Dynamics 365
Jun 17, 2026
Mar 14, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-24891
1Microsoft
1Dynamics 365
Jun 17, 2026
Mar 14, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-24879
1Microsoft
1Dynamics 365
Jun 17, 2026
Mar 14, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-23408
1Microsoft
2Azure Hdinsight
Azure Hdinsights
Jun 17, 2026
Mar 14, 2023
N/A· v4
4.5 MEDIUM· v3
N/A· v2
Azure Apache Ambari Spoofing Vulnerability
CVE-2023-23383
1Microsoft
1Azure Service Fabric
Jun 17, 2026
Mar 14, 2023
N/A· v4
4.7 MEDIUM· v3
N/A· v2
Service Fabric Explorer Spoofing Vulnerability
CVE-2023-27070
1Totaljs
1Openplatform
Jun 17, 2026
Mar 14, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
A stored cross-site scripting (XSS) vulnerability in TotalJS OpenPlatform commit b80b09d allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field.
CVE-2023-27069
1Totaljs
1Openplatform
Jun 17, 2026
Mar 14, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
A stored cross-site scripting (XSS) vulnerability in TotalJS OpenPlatform commit b80b09d allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the account name field.
CVE-2023-1397
1Online Student Management System Project
1Online Student Management System
Jun 17, 2026
Mar 14, 2023
N/A· v4
6.1 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability classified as problematic has been found in SourceCodester Online Student Management System 1.0. Affected is an unknown function of the file profile.php. The manipulation of the argument adminname leads t...Show more
A vulnerability classified as problematic has been found in SourceCodester Online Student Management System 1.0. Affected is an unknown function of the file profile.php. The manipulation of the argument adminname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222984.Show less
CVE-2023-1396
1Online Tours & Travels Management System Project
1Online Tours & Travels Management System
Jun 17, 2026
Mar 14, 2023
N/A· v4
6.1 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file admin/traveller_details.php. The manipula...Show more
A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file admin/traveller_details.php. The manipulation of the argument address leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222983.Show less
CVE-2023-1395
1Yoga Class Registration System Project
1Yoga Class Registration System
Jun 17, 2026
Mar 14, 2023
N/A· v4
6.1 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as problematic. This vulnerability affects the function query of the file admin/user/list.php. The manipulation of the...Show more
A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as problematic. This vulnerability affects the function query of the file admin/user/list.php. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222982 is the identifier assigned to this vulnerability.Show less
CVE-2022-23791
1Firmanet
1Customer Relation Manager
Jun 17, 2026
Mar 14, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting (XSS). This issue affects Cust...Show more
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting (XSS). This issue affects Customer Relation Manager: before 2022.03.13.Show less
CVE-2022-23790
1Firmanet
1Technology Customer Relation Manager
Jun 17, 2026
Mar 14, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting (XSS). This issue affects Cust...Show more
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting (XSS). This issue affects Customer Relation Manager: before 2022.03.13.Show less
CVE-2021-4195
1Firmanet
1Customer Relation Manager
Jun 17, 2026
Mar 14, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manager allows XSS Targeting HTML Attributes. This issue affects C...Show more
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manager allows XSS Targeting HTML Attributes. This issue affects Customer Relation Manager: before 2022.03.13.Show less