Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (47,473)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-0690 1Microweber 1Microweber Jun 17, 2026 Feb 19, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
CVE-2022-23376 1Wikidocs 1Wikidocs Jun 17, 2026 Feb 19, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 WikiDocs version 0.1.18 has multiple reflected XSS vulnerabilities on different pages.
CVE-2022-0678 1Microweber 1Microweber Jun 17, 2026 Feb 19, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
CVE-2022-25256 1Sas 1Web Report Studio Jun 17, 2026 Feb 19, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 SAS Web Report Studio 4.4 allows XSS. /SASWebReportStudio/logonAndRender.do has two parameters: saspfs_request_backlabel_list and saspfs_request_backurl_list. The first one affects the content of the button placed in the...Show more SAS Web Report Studio 4.4 allows XSS. /SASWebReportStudio/logonAndRender.do has two parameters: saspfs_request_backlabel_list and saspfs_request_backurl_list. The first one affects the content of the button placed in the top left. The second affects the page to which the user is directed after pressing the button, e.g., a malicious web page. In addition, the second parameter executes JavaScript, which means XSS is possible by adding a javascript: URL.Show less
CVE-2021-40840 1Liveconfig 1Liveconfig Jun 17, 2026 Feb 18, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A Stored XSS issue exists in the admin/users user administration form in LiveConfig 2.12.2.
CVE-2021-30650 1Broadcom 1Layer7 Api Management Oauth Toolkit Jun 17, 2026 Feb 18, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected cross-site scripting (XSS) vulnerability in the Symantec Layer7 API Management OAuth Toolkit (OTK) allows a remote attacker to craft a malicious URL for the OTK web UI and target OTK users with phishing attac...Show more A reflected cross-site scripting (XSS) vulnerability in the Symantec Layer7 API Management OAuth Toolkit (OTK) allows a remote attacker to craft a malicious URL for the OTK web UI and target OTK users with phishing attacks or other social engineering techniques. A successful attack allows injecting malicious code into the OTK web UI client application.Show less
CVE-2022-25323 1Zerof 1Web Server Jun 17, 2026 Feb 18, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ZEROF Web Server 2.0 allows /admin.back XSS.
CVE-2022-23647 1Prismjs 1Prism Jun 17, 2026 Feb 18, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did...Show more Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted. This bug has been fixed in v1.27.0. As a workaround, do not use the command line plugin on untrusted inputs, or sanitize all code blocks (remove all HTML code text) from all code blocks that use the command line plugin.Show less
CVE-2021-46372 1Erudika 1Scoold Jun 17, 2026 Feb 18, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown editor is vulnerable to a XSS attack when using uppercase letters.
CVE-2022-25321 1Cerebrate Project 1Cerebrate Jun 17, 2026 Feb 18, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.
CVE-2022-25317 1Cerebrate Project 1Cerebrate Jun 17, 2026 Feb 18, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-controlled description.
CVE-2021-46108 1Dlink 1Dsl 2730e Firmware Jun 17, 2026 Feb 18, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 D-Link DSL-2730E CT-20131125 devices allow XSS via the username parameter to the password page in the maintenance configuration.
CVE-2014-8597 1Php Fusion 1Phpfusion Nov 21, 2024 Feb 17, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 7.02.07 allows remote attackers to inject arbitrary web script or HTML via the status parameter in the CMS admin panel.
CVE-2022-20659 1Cisco 2Evolved Programmable Network Manager Prime Infrastructure Jun 17, 2026 Feb 17, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (...Show more A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.Show less
CVE-2022-24981 1Jqueryform 1Jqueryform Jun 17, 2026 Feb 16, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected cross-site scripting (XSS) vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to admin.php.
CVE-2022-22853 1Hospital's Patient Records Management System Project 1Hospital's Patient Records Management System Jun 17, 2026 Feb 16, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the Name field.
CVE-2022-0612 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Feb 16, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
CVE-2021-46251 1Scratchoauth2 Project 1Scratchoauth2 Jun 17, 2026 Feb 15, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected cross-site scripting (XSS) in ScratchOAuth2 before commit 1603f04e44ef67dde6ccffe866d2dca16defb293 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.
CVE-2022-24589 1Burden Project 1Burden Jun 17, 2026 Feb 15, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Burden v3.0 was discovered to contain a stored cross-site scripting (XSS) in the Add Category function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the task param...Show more Burden v3.0 was discovered to contain a stored cross-site scripting (XSS) in the Add Category function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the task parameter.Show less
CVE-2022-25203 1Jenkins 1Team Views Jun 17, 2026 Feb 15, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.

Previous 1...147814791480...2374 Next