Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (47,540)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-20659 1Cisco 2Evolved Programmable Network Manager Prime Infrastructure Jun 17, 2026 Feb 17, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (...Show more A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.Show less
CVE-2022-24981 1Jqueryform 1Jqueryform Jun 17, 2026 Feb 16, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected cross-site scripting (XSS) vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to admin.php.
CVE-2022-22853 1Hospital's Patient Records Management System Project 1Hospital's Patient Records Management System Jun 17, 2026 Feb 16, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the Name field.
CVE-2022-0612 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Feb 16, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
CVE-2021-46251 1Scratchoauth2 Project 1Scratchoauth2 Jun 17, 2026 Feb 15, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected cross-site scripting (XSS) in ScratchOAuth2 before commit 1603f04e44ef67dde6ccffe866d2dca16defb293 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.
CVE-2022-24589 1Burden Project 1Burden Jun 17, 2026 Feb 15, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Burden v3.0 was discovered to contain a stored cross-site scripting (XSS) in the Add Category function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the task param...Show more Burden v3.0 was discovered to contain a stored cross-site scripting (XSS) in the Add Category function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the task parameter.Show less
CVE-2022-25203 1Jenkins 1Team Views Jun 17, 2026 Feb 15, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.
CVE-2022-25202 1Jenkins 1Promoted Builds (simple) Jun 17, 2026 Feb 15, 2022 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer...Show more Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.Show less
CVE-2022-25191 1Jenkins 1Agent Server Parameter Jun 17, 2026 Feb 15, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configur...Show more Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.Show less
CVE-2022-25189 1Jenkins 1Custom Checkbox Parameter Jun 17, 2026 Feb 15, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Co...Show more Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.Show less
CVE-2022-25185 1Jenkins 1Generic Webhook Trigger Jun 17, 2026 Feb 15, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure...Show more Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.Show less
CVE-2022-24590 1Backdropcms 1Backdrop Jun 17, 2026 Feb 15, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web scripts or HTML.
CVE-2022-24588 1Flatpress 1Flatpress Jun 17, 2026 Feb 15, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Flatpress v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability in the Upload SVG File function.
CVE-2022-24587 1Pluxml 1Pluxml Jun 17, 2026 Feb 15, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML.
CVE-2022-24585 1Pluxml 1Pluxml Jun 17, 2026 Feb 15, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the author parameter.
CVE-2022-24227 1Boltwire 1Boltwire Jun 17, 2026 Feb 15, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability in BoltWire v7.10 and v 8.00 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the name and lastname parameters.
CVE-2022-24586 1Pluxml 1Pluxml Jun 17, 2026 Feb 15, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content and thumbnail...Show more A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content and thumbnail parameters.Show less
CVE-2021-46558 1Issabel 1Pbx Jun 17, 2026 Feb 15, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Multiple cross-site scripting (XSS) vulnerabilities in the Add User module of Issabel PBX 20200102 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the username and password f...Show more Multiple cross-site scripting (XSS) vulnerabilities in the Add User module of Issabel PBX 20200102 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the username and password fields.Show less
CVE-2021-46557 1Vicidial 1Vicidial Jun 17, 2026 Feb 15, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Vicidial 2.14-783a was discovered to contain a cross-site scripting (XSS) vulnerability via the input tabs.
CVE-2022-0589 1Librenms 1Librenms Jun 17, 2026 Feb 15, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0.

Previous 1...148214831484...2377 Next