← Back
CWE-79

47,394 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (47,394)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-31734
1Cisco
2Ws C2940 8tf S Firmware
Ws C2940 8tt S Firmware
Jun 17, 2026
Jun 20, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cisco Catalyst 2940 Series Switches provided by Cisco Systems, Inc. contain a reflected cross-site scripting vulnerability regarding error page generation. An arbitrary script may be executed on the web browser of the us...Show more
Cisco Catalyst 2940 Series Switches provided by Cisco Systems, Inc. contain a reflected cross-site scripting vulnerability regarding error page generation. An arbitrary script may be executed on the web browser of the user who is using the product. The affected firmware is prior to 12.2(50)SY released in 2011, and Cisco Catalyst 2940 Series Switches have been retired since January 2015Show less
CVE-2022-2130
1Microweber
1Microweber
Jun 17, 2026
Jun 20, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.17.
CVE-2017-20061
1Elefantcms
1Elefant Cms
Nov 21, 2024
Jun 20, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A vulnerability has been found in Elefant CMS 1.3.12-RC and classified as problematic. This vulnerability affects unknown code of the file /admin/extended. The manipulation of the argument name with the input %3Cimg%20sr...Show more
A vulnerability has been found in Elefant CMS 1.3.12-RC and classified as problematic. This vulnerability affects unknown code of the file /admin/extended. The manipulation of the argument name with the input %3Cimg%20src=no%20onerror=alert(1)%3E leads to basic cross site scripting (Reflected). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.Show less
CVE-2017-20060
1Elefantcms
1Elefant Cms
Nov 21, 2024
Jun 20, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A vulnerability, which was classified as problematic, was found in Elefant CMS 1.3.12-RC. This affects an unknown part of the component Blog Post Handler. The manipulation leads to basic cross site scripting (Persistent)...Show more
A vulnerability, which was classified as problematic, was found in Elefant CMS 1.3.12-RC. This affects an unknown part of the component Blog Post Handler. The manipulation leads to basic cross site scripting (Persistent). It is possible to initiate the attack remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.Show less
CVE-2017-20059
1Elefantcms
1Elefant Cms
Nov 21, 2024
Jun 20, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A vulnerability, which was classified as problematic, has been found in Elefant CMS 1.3.12-RC. Affected by this issue is some unknown functionality of the component Title Handler. The manipulation with the input </title>...Show more
A vulnerability, which was classified as problematic, has been found in Elefant CMS 1.3.12-RC. Affected by this issue is some unknown functionality of the component Title Handler. The manipulation with the input </title><img src=no onerror=alert(1)> leads to basic cross site scripting (Persistent). The attack may be launched remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.Show less
CVE-2017-20058
1Elefantcms
1Elefantcms
Nov 21, 2024
Jun 20, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A vulnerability classified as problematic was found in Elefant CMS 1.3.12-RC. Affected by this vulnerability is an unknown functionality of the component Version Comparison. The manipulation leads to basic cross site scr...Show more
A vulnerability classified as problematic was found in Elefant CMS 1.3.12-RC. Affected by this vulnerability is an unknown functionality of the component Version Comparison. The manipulation leads to basic cross site scripting (Persistent). The attack can be launched remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.Show less
CVE-2017-20057
1Elefantcms
1Elefant Cms
Nov 21, 2024
Jun 20, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A vulnerability classified as problematic has been found in Elefant CMS 1.3.12-RC. Affected is an unknown function. The manipulation of the argument username leads to basic cross site scripting (Persistent). It is possib...Show more
A vulnerability classified as problematic has been found in Elefant CMS 1.3.12-RC. Affected is an unknown function. The manipulation of the argument username leads to basic cross site scripting (Persistent). It is possible to launch the attack remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.Show less
CVE-2022-31875
1Trendnet
1Tv Ip110wn Firmware
Jun 17, 2026
Jun 17, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68) has an xss vulnerability via the proname parameter in /admin/scheprofile.cgi
CVE-2022-31873
1Trendnet
1Tv Ip110wn Firmware
Jun 17, 2026
Jun 17, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68) has an XSS vulnerability via the prefix parameter in /admin/general.cgi.
CVE-2022-32442
1Yuba
1U5cms
Jun 17, 2026
Jun 17, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
u5cms version 8.3.5 is vulnerable to Cross Site Scripting (XSS). When a user accesses the default home page if the parameter passed in is http://127.0.0.1/? "Onmouseover=%27tzgl (96502)%27bad=", it can cause html injecti...Show more
u5cms version 8.3.5 is vulnerable to Cross Site Scripting (XSS). When a user accesses the default home page if the parameter passed in is http://127.0.0.1/? "Onmouseover=%27tzgl (96502)%27bad=", it can cause html injection.Show less
CVE-2022-2113
1Inventree Project
1Inventree
Jun 17, 2026
Jun 17, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2.
CVE-2021-45026
1Rocketsoftware
1Ags Zena
Jul 9, 2026
Jun 17, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
ASG technologies ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cross Site Scripting (XSS).
CVE-2022-30326
1Trendnet
1Tew 831dr Firmware
Jun 17, 2026
Jun 16, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The network pre-shared key field on the web interface is vulnerable to XSS. An attacker can use a simple XSS payload to crash the basic.config page of...Show more
An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The network pre-shared key field on the web interface is vulnerable to XSS. An attacker can use a simple XSS payload to crash the basic.config page of the web interface.Show less
CVE-2022-31299
1Angtech
1Haraj
Jun 17, 2026
Jun 16, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Haraj v3.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the User Upgrade Form.
CVE-2021-36609
1Webtareas Project
1Webtareas
Jun 17, 2026
Jun 16, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /linkedcontent/editfolder.php.
CVE-2021-36608
1Webtareas Project
1Webtareas
Jun 17, 2026
Jun 16, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /projects/editproject.php.
CVE-2021-33295
1Joplin Project
1Joplin
Jun 17, 2026
Jun 16, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.
CVE-2022-31301
1Angtech
1Haraj
Jun 17, 2026
Jun 16, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Haraj v3.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Post Ads component.
CVE-2021-36827
1Ninjaforms
1Ninja Forms
Jun 17, 2026
Jun 16, 2022
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label".
CVE-2022-31298
1Angtech
1Haraj
Jun 17, 2026
Jun 16, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A cross-site scripting vulnerability in the ads comment section of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.