← Back
CWE-79

47,188 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (47,188)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-43688
1Concretecms
1Concrete Cms
Jun 17, 2026
Nov 14, 2022
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in icons since the Microsoft application tile color is not sanitized. Remediate by updating to...Show more
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in icons since the Microsoft application tile color is not sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.Show less
CVE-2022-43968
1Concretecms
1Concrete Cms
Jun 17, 2026
Nov 14, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the dashboard icons due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
CVE-2022-43967
1Concretecms
1Concrete Cms
Jun 17, 2026
Nov 14, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the multilingual report due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
CVE-2022-38167
1Nintex
1Workflow
Jun 17, 2026
Nov 14, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS.
CVE-2022-44390
1Eyoucms
1Eyoucms
Jun 17, 2026
Nov 14, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
A cross-site scripting (XSS) vulnerability in EyouCMS V1.5.9-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Record Number text field.
CVE-2022-34317
1Ibm
1Cics Tx
Jun 17, 2026
Nov 14, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
IBM CICS TX 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclo...Show more
IBM CICS TX 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229459. Show less
CVE-2022-43694
1Concretecms
1Concrete Cms
Jun 17, 2026
Nov 14, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the image manipulation library due to un-sanitized output.
CVE-2022-43692
1Concretecms
1Concrete Cms
Jun 17, 2026
Nov 14, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS - user can cause an administrator to trigger reflected XSS with a url if the targeted administrator is using an ol...Show more
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS - user can cause an administrator to trigger reflected XSS with a url if the targeted administrator is using an old browser that lacks XSS protection. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.Show less
CVE-2022-34315
1Ibm
1Cics Tx
Jun 17, 2026
Nov 14, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
IBM CICS TX 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclo...Show more
IBM CICS TX 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229451. Show less
CVE-2022-3992
1Sanitization Management System Project
1Sanitization Management System
Jun 17, 2026
Nov 14, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A vulnerability classified as problematic was found in SourceCodester Sanitization Management System. Affected by this vulnerability is an unknown functionality of the file admin/?page=system_info of the component Banner...Show more
A vulnerability classified as problematic was found in SourceCodester Sanitization Management System. Affected by this vulnerability is an unknown functionality of the file admin/?page=system_info of the component Banner Image Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-213571.Show less
CVE-2022-43342
1Eramba
1Eramba
Jun 17, 2026
Nov 14, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
A stored cross-site scripting (XSS) vulnerability in the Add function of Eramba GRC Software c2.8.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the KPI Title text field.
CVE-2021-40272
1Op5
1Monitor
Jun 17, 2026
Nov 14, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
OP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS).
CVE-2022-3631
1Digitialpixies
1Oauth Client
Jun 17, 2026
Nov 14, 2022
N/A· v4
4.8 MEDIUM· v3
N/A· v2
The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks ev...Show more
The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).Show less
CVE-2022-3578
1Metagauss
1Profilegrid
Jun 17, 2026
Nov 14, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
CVE-2022-3539
1Themepoints
1Super Testimonials
Jun 17, 2026
Nov 14, 2022
N/A· v4
4.8 MEDIUM· v3
N/A· v2
The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attac...Show more
The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.Show less
CVE-2022-3484
1Wpb Show Core Project
1Wpb Show Core
Jun 17, 2026
Nov 14, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
CVE-2022-3469
1Marcomilesi
1Wp Attachments
Jun 17, 2026
Nov 14, 2022
N/A· v4
4.8 MEDIUM· v3
N/A· v2
The WP Attachments WordPress plugin before 5.0.5 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfil...Show more
The WP Attachments WordPress plugin before 5.0.5 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).Show less
CVE-2022-3415
1Bluecoral
1Chat Bubble
Jun 17, 2026
Nov 14, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when a...Show more
The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin view the related contact messageShow less
CVE-2022-3988
1Frappe
1Frappe
Jun 17, 2026
Nov 14, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functionality of the file frappe/templates/includes/navbar/navbar_search.html of the component Search. The man...Show more
A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functionality of the file frappe/templates/includes/navbar/navbar_search.html of the component Search. The manipulation of the argument q leads to cross site scripting. The attack may be launched remotely. The name of the patch is bfab7191543961c6cb77fe267063877c31b616ce. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213560.Show less
CVE-2022-3968
1Emlog
1Emlog
Jun 17, 2026
Nov 13, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A vulnerability has been found in emlog and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/article_save.php. The manipulation of the argument tag leads to cross si...Show more
A vulnerability has been found in emlog and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/article_save.php. The manipulation of the argument tag leads to cross site scripting. The attack can be launched remotely. The name of the patch is 5bf7a79826e0ea09bcc8a21f69a0c74107761a02. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213547.Show less