Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (47,551)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-46080 1Vehicle Service Management System Project 1Vehicle Service Management System Jun 17, 2026 Jan 6, 2022 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 A Cross Site Request Forgery (CSRF) vulnerability exists in Vehicle Service Management System 1.0. An successful CSRF attacks leads to Stored Cross Site Scripting Vulnerability.
CVE-2021-44584 1Emlog 1Emlog Jun 17, 2026 Jan 6, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in index.php in emlog version <= pro-1.0.7 allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2021-36739 1Apache 1Pluto Jun 17, 2026 Jan 6, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.
CVE-2021-36738 1Apache 1Pluto Jun 17, 2026 Jan 6, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.w...Show more The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifactShow less
CVE-2021-36737 1Apache 1Pluto Jun 17, 2026 Jan 6, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact
CVE-2021-46144 2Debian Roundcube 2Debian Linux Roundcube Jun 17, 2026 Jan 6, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.
CVE-2022-0121 1Hoppscotch 1Hoppscotch Jun 17, 2026 Jan 6, 2022 N/A· v4 8.0 HIGH· v3 6.0 MEDIUM· v2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoppscotch hoppscotch/hoppscotch.This issue affects hoppscotch/hoppscotch before 2.1.1.
CVE-2020-27428 1Mit 1Scratch Svg Renderer Jun 17, 2026 Jan 6, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file.
CVE-2020-23986 1Github Readme Stats Project 1Github Readme Stats Jun 17, 2026 Jan 6, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Github Read Me Stats commit 3c7220e4f7144f6cb068fd433c774f6db47ccb95 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the function renderError.
CVE-2022-22109 1Daybydaycrm 1Daybyday Crm Jun 17, 2026 Jan 5, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are e...Show more In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks.Show less
CVE-2021-31589 1Beyondtrust 1Appliance Base Software Jun 17, 2026 Jan 5, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Software version 6.0.1 and older, which allows the injection of unauthenticated, specially-crafted web...Show more A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Software version 6.0.1 and older, which allows the injection of unauthenticated, specially-crafted web requests without proper sanitization.Show less
CVE-2022-21650 1Convos 1Convos Jun 17, 2026 Jan 4, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension...Show more Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after uploading a file the XSS attack is triggered upon a user viewing the file. Through this vulnerability, an attacker is capable to execute malicious scripts. Users are advised to update as soon as possible.Show less
CVE-2022-21649 1Convos 1Convos Jun 17, 2026 Jan 4, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an <a> tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping...Show more Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an <a> tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "<" or ">" but escaping for double quotes does not exist. Through this vulnerability, an attacker is capable to execute malicious scripts. Users are advised to update as soon as possible.Show less
CVE-2022-21648 1Nette 1Latte Jun 17, 2026 Jan 4, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages ge...Show more Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources.Show less
CVE-2021-43677 1Fluxbb 1Fluxbb Jul 9, 2026 Jan 4, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Fluxbb v1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability.
CVE-2021-41236 1Oroinc 1Oroplatform Jun 17, 2026 Jan 4, 2022 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to email template content. An attacker must have permission to create or edit an emai...Show more OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to email template content. An attacker must have permission to create or edit an email template. For successful payload, execution the attacked user must preview a vulnerable email template. There are no workarounds that address this vulnerability. Users are advised to upgrade as soon as is possible.Show less
CVE-2021-43942 1Atlassian 2Jira Server Jira Server And Data Center Jun 17, 2026 Jan 4, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custo...Show more Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue, the attacker must trick a user into visiting a malicious website. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.Show less
CVE-2021-46109 1Asus 1Rt Ac52u B1 Firmware Jun 17, 2026 Jan 3, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Invalid input sanitizing leads to reflected Cross Site Scripting (XSS) in ASUS RT-AC52U_B1 3.0.0.4.380.10931 can lead to a user session hijack.
CVE-2021-25040 1Booking Calendar Project 1Booking Calendar Jun 17, 2026 Jan 3, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
CVE-2021-25027 1Ideabox 1Powerpack Addons For Elementor Jun 17, 2026 Jan 3, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The PowerPack Addons for Elementor WordPress plugin before 2.6.2 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue

Previous 1...149915001501...2378 Next