← Back
CWE-79

47,382 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (47,382)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-2932
1Bdg
1Mobiledoc Kit
Jun 17, 2026
Aug 22, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Reflected in GitHub repository bustle/mobiledoc-kit prior to 0.14.2.
CVE-2022-2890
1Yetiforce
1Yetiforce Customer Relationship Management
Jun 17, 2026
Aug 22, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CVE-2022-1340
1Yetiforce
1Yetiforce Customer Relationship Management
Jun 17, 2026
Aug 22, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CVE-2022-36251
1Oretnom23
1Clinic's Patient Management System
Jun 17, 2026
Aug 22, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Clinic's Patient Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via patients.php.
CVE-2022-2885
1Yetiforce
1Yetiforce Customer Relationship Management
Jun 17, 2026
Aug 21, 2022
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CVE-2022-35554
1Bpcbt
1Smartvista
Jul 9, 2026
Aug 19, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Multiple reflected XSS vulnerabilities occur when handling error message of BPC SmartVista version 3.28.0 allowing an attacker to execute javascript code at client side.
CVE-2022-0542
1Chatwoot
1Chatwoot
Jun 17, 2026
Aug 19, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0.
CVE-2022-37254
1Dolphinphp Project
1Dolphinphp
Jun 17, 2026
Aug 19, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
DolphinPHP 1.5.1 is vulnerable to Cross Site Scripting (XSS) via Background - > System - > system function - > configuration management.
CVE-2022-35910
1Jellyfin
1Jellyfin
Jun 17, 2026
Aug 19, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
In Jellyfin before 10.8, stored XSS allows theft of an admin access token.
CVE-2022-1021
1Chatwoot
1Chatwoot
Jun 17, 2026
Aug 19, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0.
CVE-2020-23466
1Phpgurukul
1Online Marriage Registration System
Jun 17, 2026
Aug 19, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross Site Scripting (XSS) vulnerability exists in the phpgurukul Online Marriage Registration System 1.0 allows attackers to run arbitrary code via the wzipcode field.
CVE-2022-35213
1Ecommerce Codeigniter Bootstrap Project
1Ecommerce Codeigniter Bootstrap
Jun 17, 2026
Aug 18, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Ecommerce-CodeIgniter-Bootstrap before commit 56465f was discovered to contain a cross-site scripting (XSS) vulnerability via the function base_url() at /blog/blogpublish.php.
CVE-2022-35212
1Oscommerce
1Oscommerce
Jun 17, 2026
Aug 18, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
osCommerce2 before v2.3.4.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the function tep_db_error().
CVE-2021-32862
2Debian
Jupyter
2Debian Linux
Nbconvert
Jun 17, 2026
Aug 18, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arb...Show more
The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).Show less
CVE-2022-37063
1Flir
1Flir Ax8 Firmware
Jun 17, 2026
Aug 18, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Cross Site Scripting (XSS) due to improper input sanitization. An authenticated remote attacker can execute arbitrary JavaScript...Show more
All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Cross Site Scripting (XSS) due to improper input sanitization. An authenticated remote attacker can execute arbitrary JavaScript code in the web management interface. A successful exploit could allow the attacker to insert malicious JavaScript code. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.Show less
CVE-2022-35174
1Getkirby
1Starterkit
Jun 17, 2026
Aug 18, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
A stored cross-site scripting (XSS) vulnerability in Kirby's Starterkit v3.7.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Tags field.
CVE-2022-33151
1Cybozu
1Office
Jun 17, 2026
Aug 18, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVE-2022-30604
1Cybozu
1Office
Jun 17, 2026
Aug 18, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVE-2022-29487
1Cybozu
1Office
Jun 17, 2026
Aug 18, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVE-2022-28715
1Cybozu
1Office
Jun 17, 2026
Aug 18, 2022
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors.