← Back
CWE-79

47,382 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (47,382)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-38172
1Servicenow
1Servicenow
Jun 17, 2026
Aug 23, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboard.
CVE-2022-38664
1Jenkins
1Job Configuration History
Jun 17, 2026
Aug 23, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by...Show more
Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names.Show less
CVE-2022-36405
1Amcharts
1Amcharts\
Jun 17, 2026
Aug 23, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in amCharts: Charts and Maps plugin <= 1.4 at WordPress.
CVE-2022-36347
1Thealpinepress
1Alpine Phototile For Pinterest
Jun 17, 2026
Aug 23, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alpine Press Alpine PhotoTile for Pinterest plugin <= 1.3.1 at WordPress.
CVE-2022-36341
1As Create Pinterest Pinboard Pages Project
1As Create Pinterest Pinboard Pages
Jun 17, 2026
Aug 23, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Authenticated (subscriber+) plugin settings change leading to Stored Cross-Site Scripting (XSS) vulnerability in Akash soni's AS – Create Pinterest Pinboard Pages plugin <= 1.0 at WordPress.
CVE-2022-36282
1Search Exclude Project
1Search Exclude
Jun 17, 2026
Aug 23, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy's Search Exclude plugin <= 1.2.6 at WordPress.
CVE-2022-34658
1W3eden
1Download Manager
Jun 17, 2026
Aug 23, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.
CVE-2022-34648
1Uploading Svg, Webp And Ico Files Project
1Uploading Svg, Webp And Ico Files
Jun 17, 2026
Aug 23, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.
CVE-2022-29476
18degreethemes
1Notification Bar
Jun 17, 2026
Aug 23, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in 8 Degree Themes otification Bar for WordPress plugin <= 1.1.8 at WordPress.
CVE-2022-35278
2Apache
Netapp
4Active Iq Unified Manager
Activemq ArtemisArtemis+1 more
Jun 17, 2026
Aug 23, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.
CVE-2022-2956
1Noxen Project
1Noxen
Jun 17, 2026
Aug 23, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A vulnerability classified as problematic has been found in ConsoleTVs Noxen. Affected is an unknown function of the file /Noxen-master/users.php. The manipulation of the argument create_user_username with the input "><s...Show more
A vulnerability classified as problematic has been found in ConsoleTVs Noxen. Affected is an unknown function of the file /Noxen-master/users.php. The manipulation of the argument create_user_username with the input "><script>alert(/xss/)</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-207000.Show less
CVE-2022-2796
1Pimcore
1Pimcore
Jun 17, 2026
Aug 23, 2022
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4.
CVE-2022-36350
1Pukiwiki
1Pukiwiki
Jun 17, 2026
Aug 23, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Stored cross-site scripting vulnerability in PukiWiki versions 1.3.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVE-2022-27637
1Pukiwiki
1Pukiwiki
Jun 17, 2026
Aug 23, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Reflected cross-site scripting vulnerability in PukiWiki versions 1.5.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVE-2022-2829
1Yetiforce
1Yetiforce Customer Relationship Management
Jun 17, 2026
Aug 23, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CVE-2019-25075
1Gravitee
1Api Management
Jun 17, 2026
Aug 23, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /management/users/register request.
CVE-2022-32772
1Wwbn
1Avideo
Jun 17, 2026
Aug 22, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An att...Show more
A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "msg" parameter which is inserted into the document with insufficient sanitization.Show less
CVE-2022-32771
1Wwbn
1Avideo
Jun 17, 2026
Aug 22, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An att...Show more
A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "success" parameter which is inserted into the document with insufficient sanitization.Show less
CVE-2022-32770
1Wwbn
1Avideo
Jun 17, 2026
Aug 22, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An att...Show more
A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "toast" parameter which is inserted into the document with insufficient sanitization.Show less
CVE-2022-30690
1Wwbn
1Avideo
Jun 17, 2026
Aug 22, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker...Show more
A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.Show less