Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (47,425)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-20781 1Cisco 1Asyncos Jun 17, 2026 Apr 6, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack a...Show more A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious data into a specific data field in an affected interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface.Show less
CVE-2022-20741 1Cisco 1Secure Network Analytics Jun 17, 2026 Apr 6, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A vulnerability in the web-based management interface of the Network Diagrams application for Cisco Secure Network Analytics, formerly Stealthwatch Enterprise, could allow an authenticated, remote attacker to conduct a c...Show more A vulnerability in the web-based management interface of the Network Diagrams application for Cisco Secure Network Analytics, formerly Stealthwatch Enterprise, could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.Show less
CVE-2021-32585 1Fortinet 1Fortiwan Jun 17, 2026 Apr 6, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiWAN before 4.5.9 may allow an attacker to perform a stored cross-site scripting attack via specifically crafted HTTP requests.
CVE-2022-27107 1Orangehrm 1Orangehrm Jun 17, 2026 Apr 6, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideo[linkAddress]" parameter
CVE-2022-1234 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Apr 6, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web page...Show more XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device.Show less
CVE-2021-40374 1Apperta 1Openeye Jun 17, 2026 Apr 6, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A stored cross-site scripting (XSS) vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patient's details allows remote attackers to inject arbitrary web script or HTML via the Address1 paramete...Show more A stored cross-site scripting (XSS) vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patient's details allows remote attackers to inject arbitrary web script or HTML via the Address1 parameter. This JavaScript then executes when the patient profile is loaded, which could be used in a XSS attack.Show less
CVE-2022-25373 1Zohocorp 1Manageengine Supportcenter Plus Jun 17, 2026 Apr 5, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history.
CVE-2022-24811 1Combodo 1Itop Jun 17, 2026 Apr 5, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Combodi iTop is a web based IT Service Management tool. Prior to versions 2.7.6 and 3.0.0, cross-site scripting is possible for scripts outside of script tags when displaying HTML attachments. This issue is fixed in vers...Show more Combodi iTop is a web based IT Service Management tool. Prior to versions 2.7.6 and 3.0.0, cross-site scripting is possible for scripts outside of script tags when displaying HTML attachments. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.Show less
CVE-2022-28650 1Jetbrains 1Youtrack Jun 17, 2026 Apr 5, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI
CVE-2022-28648 1Jetbrains 1Youtrack Jun 17, 2026 Apr 5, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered
CVE-2022-27462 1Wwbn 1Avideo Jun 17, 2026 Apr 5, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php.
CVE-2022-0602 1Tastyigniter 1Tastyigniter Jun 17, 2026 Apr 5, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site Scripting (XSS) - DOM in GitHub repository tastyigniter/tastyigniter prior to 3.3.0.
CVE-2020-28847 1Valine.js 1Valine Jun 17, 2026 Apr 5, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment.
CVE-2022-26615 1College Website Content Management System Project 1College Website Content Management System Jun 17, 2026 Apr 5, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A cross-site scripting (XSS) vulnerability in College Website Content Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User Profile Name text fields...Show more A cross-site scripting (XSS) vulnerability in College Website Content Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User Profile Name text fields.Show less
CVE-2022-27441 1Tpcms Project 1Tpcms Jun 17, 2026 Apr 4, 2022 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 A stored cross-site scripting (XSS) vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Phone text box.
CVE-2022-25618 1Tms Outsource 1Wpdatatables Lite Jun 17, 2026 Apr 4, 2022 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpDataTables (WordPress plugin) versions <= 2.1.27
CVE-2022-25613 1Foliovision 1Fv Flowplayer Video Player Jun 17, 2026 Apr 4, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter.
CVE-2022-23697 1Hp 1Oneview Jun 17, 2026 Apr 4, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to resolve this vulnerability in HPE OneView.
CVE-2022-1190 1Gitlab 1Gitlab Jun 17, 2026 Apr 4, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue...Show more Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.Show less
CVE-2022-1175 1Gitlab 1Gitlab Jun 17, 2026 Apr 4, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by inject...Show more Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.Show less

Previous 1...145314541455...2372 Next