Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (47,383)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-34988 1Inoutscripts 1Blockchain Altexchanger Jun 17, 2026 Jul 26, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Inout Blockchain AltExchanger v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/js.
CVE-2020-36290 1Atlassian 2Confluence Data Center Confluence Server Jun 17, 2026 Jul 26, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog...Show more The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the page excerpt functionality.Show less
CVE-2022-35131 1Joplinapp 1Joplin Jul 9, 2026 Jul 25, 2022 N/A· v4 9.0 CRITICAL· v3 N/A· v2 Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.
CVE-2022-34966 1Openteknik 1Open Source Social Network Jun 17, 2026 Jul 25, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an HTML injection vulnerability via the location parameter at http://ip_address/:port/ossn/home.
CVE-2022-22999 1Westerndigital 8My Cloud Dl2100 Firmware My Cloud Dl4100 FirmwareMy Cloud Ex2100 Firmware+5 more Jun 17, 2026 Jul 25, 2022 N/A· v4 4.8 MEDIUM· v3 N/A· v2 Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privileges access to drives being backed up to construct and inject JavaScript payload...Show more Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privileges access to drives being backed up to construct and inject JavaScript payloads into an authenticated user's browser. As a result, it may be possible to gain control over the authenticated session, steal data, modify settings, or redirect the user to malicious websites. The scope of impact can extend to other components.Show less
CVE-2022-34962 1Openteknik 1Open Source Social Network Jun 17, 2026 Jul 25, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Group Timeline module.
CVE-2022-2059 1Pandorafms 1Pandora Fms Jun 17, 2026 Jul 25, 2022 N/A· v4 4.8 MEDIUM· v3 N/A· v2 In Pandora FMS v7.0NG.761 and below, in the agent creation section, the alias parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administrator privileges log...Show more In Pandora FMS v7.0NG.761 and below, in the agent creation section, the alias parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administrator privileges logged in the system.Show less
CVE-2022-2032 1Pandorafms 1Pandora Fms Jun 17, 2026 Jul 25, 2022 N/A· v4 4.8 MEDIUM· v3 N/A· v2 In Pandora FMS v7.0NG.761 and below, in the file manager section, the dirname parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administrator privileges log...Show more In Pandora FMS v7.0NG.761 and below, in the file manager section, the dirname parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administrator privileges logged in the system.Show less
CVE-2022-35653 3Fedoraproject MoodleRedhat 3Enterprise Linux FedoraMoodle Jun 17, 2026 Jul 25, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a spec...Show more A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.Show less
CVE-2022-35651 3Fedoraproject MoodleRedhat 3Enterprise Linux FedoraMoodle Jun 17, 2026 Jul 25, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafte...Show more A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks.Show less
CVE-2022-34964 1Openteknik 1Open Source Social Network Jun 17, 2026 Jul 25, 2022 N/A· v4 4.8 MEDIUM· v3 N/A· v2 OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the SitePages module.
CVE-2022-34963 1Openteknik 1Open Source Social Network Jun 17, 2026 Jul 25, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the News Feed module.
CVE-2022-34961 1Openteknik 1Open Source Social Network Jun 17, 2026 Jul 25, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Users Timeline module.
CVE-2022-2523 1Fava Project 1Fava Jun 17, 2026 Jul 25, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.
CVE-2022-2514 1Fava Project 1Fava Jun 17, 2026 Jul 25, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.
CVE-2022-21802 1Grapesjs 1Grapesjs Jun 17, 2026 Jul 25, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting (XSS) due to an improper sanitization of the class name in Selector Manager.
CVE-2020-28459 1Markdown It Decorate Project 1Markdown It Decorate Jun 17, 2026 Jul 25, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 This affects all versions of package markdown-it-decorate. An attacker can add an event handler or use javascript:xxx for the link.
CVE-2020-28455 1Markdown It Toc Project 1Markdown It Toc Jun 17, 2026 Jul 25, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped.
CVE-2022-2341 1Simple Page Transition Project 1Simple Page Transition Jun 17, 2026 Jul 25, 2022 N/A· v4 4.8 MEDIUM· v3 N/A· v2 The Simple Page Transition WordPress plugin through 1.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the un...Show more The Simple Page Transition WordPress plugin through 1.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)Show less
CVE-2022-2340 1W Dalil Project 1W Dalil Jun 17, 2026 Jul 25, 2022 N/A· v4 4.8 MEDIUM· v3 N/A· v2 The W-DALIL WordPress plugin through 2.0 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capab...Show more The W-DALIL WordPress plugin through 2.0 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)Show less

Previous 1...139914001401...2370 Next