Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (47,169)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-42354 1Adobe 2Experience Manager Experience Manager Cloud Service Jun 17, 2026 Dec 19, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable...Show more Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.Show less
CVE-2022-42352 1Adobe 2Experience Manager Experience Manager Cloud Service Jun 17, 2026 Dec 19, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable...Show more Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.Show less
CVE-2022-42350 1Adobe 2Experience Manager Experience Manager Cloud Service Jun 17, 2026 Dec 19, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable...Show more Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.Show less
CVE-2022-42349 1Adobe 2Experience Manager Experience Manager Cloud Service Jun 17, 2026 Dec 19, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable...Show more Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.Show less
CVE-2022-42348 1Adobe 2Experience Manager Experience Manager Cloud Service Jun 17, 2026 Dec 19, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable...Show more Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.Show less
CVE-2022-42346 1Adobe 2Experience Manager Experience Manager Cloud Service Jun 17, 2026 Dec 19, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable...Show more Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.Show less
CVE-2022-42345 1Adobe 2Experience Manager Experience Manager Cloud Service Jun 17, 2026 Dec 19, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable...Show more Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.Show less
CVE-2022-35695 1Adobe 2Experience Manager Experience Manager Cloud Service Jun 17, 2026 Dec 19, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable...Show more Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.Show less
CVE-2022-35693 1Adobe 2Experience Manager Experience Manager Cloud Service Jun 17, 2026 Dec 19, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable...Show more Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.Show less
CVE-2022-30679 1Adobe 2Experience Manager Experience Manager Cloud Service Jun 17, 2026 Dec 19, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable...Show more Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.Show less
CVE-2022-40435 1Employee Performance Evaluation System Project 1Employee Performance Evaluation System Jul 9, 2026 Dec 19, 2022 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Employee Performance Evaluation System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via adding new entries under the Departments and Designations module.
CVE-2022-3987 1Noorsplugin 1Responsive Lightbox2 Jun 17, 2026 Dec 19, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The Responsive Lightbox2 WordPress plugin before 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to p...Show more The Responsive Lightbox2 WordPress plugin before 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacksShow less
CVE-2022-4609 1Usememos 1Memos Jun 17, 2026 Dec 19, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
CVE-2022-40743 1Apache 1Traffic Server Jun 17, 2026 Dec 19, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache poisoning attacks.This issue affects Apache Traffic Server: 9.0...Show more Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache poisoning attacks.This issue affects Apache Traffic Server: 9.0.0 to 9.1.3. Users should upgrade to 9.1.4 or later versions. Show less
CVE-2022-3877 1Clickstudios 1Passwordstate Jun 17, 2026 Dec 19, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected is an unknown function of the component URL Field Handler. The manipulat...Show more A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected is an unknown function of the component URL Field Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. VDB-216246 is the identifier assigned to this vulnerability.Show less
CVE-2022-38653 1Hcltech 1Digital Experience Jun 17, 2026 Dec 19, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded.
CVE-2022-46287 1Jacic 1Electronic Bidding Core System Jun 17, 2026 Dec 19, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to inject an arbitrary script.
CVE-2022-41993 1Jacic 1Electronic Bidding Core System Jun 17, 2026 Dec 19, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to inject an arbitrary script.
CVE-2021-4257 1Ctrlo 1Lenio Jun 17, 2026 Dec 18, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A vulnerability was found in ctrlo lenio. It has been declared as problematic. This vulnerability affects unknown code of the file views/task.tt of the component Task Handler. The manipulation of the argument site.org.na...Show more A vulnerability was found in ctrlo lenio. It has been declared as problematic. This vulnerability affects unknown code of the file views/task.tt of the component Task Handler. The manipulation of the argument site.org.name/check.name/task.tasktype.name/task.name leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 698c5fa465169d6f23c6a41ca4b1fc9a7869013a. It is recommended to apply a patch to fix this issue. VDB-216214 is the identifier assigned to this vulnerability.Show less
CVE-2021-4256 1Ctrlo 1Lenio Jun 17, 2026 Dec 18, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A vulnerability was found in ctrlo lenio. It has been classified as problematic. This affects an unknown part of the file views/index.tt. The manipulation of the argument task.name/task.site.org.name leads to cross site...Show more A vulnerability was found in ctrlo lenio. It has been classified as problematic. This affects an unknown part of the file views/index.tt. The manipulation of the argument task.name/task.site.org.name leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is e1646d5cd0a2fbab9eb505196dd2ca1c9e4cdd97. It is recommended to apply a patch to fix this issue. The identifier VDB-216213 was assigned to this vulnerability.Show less

Previous 1...132713281329...2359 Next