← Back
CWE-79

47,679 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (47,679)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-46073
1Vehicle Service Management System Project
1Vehicle Service Management System
Jun 17, 2026
Jan 6, 2022
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the User List Section in login panel.
CVE-2021-46072
1Vehicle Service Management System Project
1Vehicle Service Management System
Jun 17, 2026
Jan 6, 2022
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service List Section in login panel.
CVE-2021-46071
1Vehicle Service Management System Project
1Vehicle Service Management System
Jun 17, 2026
Jan 6, 2022
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Category List Section in login panel.
CVE-2021-46070
1Vehicle Service Management System Project
1Vehicle Service Management System
Jun 17, 2026
Jan 6, 2022
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service Requests Section in login panel.
CVE-2021-46069
1Vehicle Service Management System Project
1Vehicle Service Management System
Jun 17, 2026
Jan 6, 2022
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Mechanic List Section in login panel.
CVE-2021-46068
1Vehicle Service Management System Project
1Vehicle Service Management System
Jun 17, 2026
Jan 6, 2022
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the My Account Section in login panel.
CVE-2021-45745
1Bludit
1Bludit
Jun 17, 2026
Jan 6, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A Stored Cross Site Scripting (XSS) vulnerability exists in Bludit 3.13.1 via the About Plugin in login panel.
CVE-2021-45744
1Bludit
1Bludit
Jun 17, 2026
Jan 6, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A Stored Cross Site Scripting (XSS) vulnerability exists in bludit 3.13.1 via the TAGS section in login panel.
CVE-2021-46080
1Vehicle Service Management System Project
1Vehicle Service Management System
Jun 17, 2026
Jan 6, 2022
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
A Cross Site Request Forgery (CSRF) vulnerability exists in Vehicle Service Management System 1.0. An successful CSRF attacks leads to Stored Cross Site Scripting Vulnerability.
CVE-2021-44584
1Emlog
1Emlog
Jun 17, 2026
Jan 6, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in index.php in emlog version <= pro-1.0.7 allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2021-36739
1Apache
1Pluto
Jun 17, 2026
Jan 6, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.
CVE-2021-36738
1Apache
1Pluto
Jun 17, 2026
Jan 6, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.w...Show more
The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifactShow less
CVE-2021-36737
1Apache
1Pluto
Jun 17, 2026
Jan 6, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact
CVE-2021-46144
2Debian
Roundcube
2Debian Linux
Roundcube
Jun 17, 2026
Jan 6, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.
CVE-2022-0121
1Hoppscotch
1Hoppscotch
Jun 17, 2026
Jan 6, 2022
N/A· v4
8.0 HIGH· v3
6.0 MEDIUM· v2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoppscotch hoppscotch/hoppscotch.This issue affects hoppscotch/hoppscotch before 2.1.1.
CVE-2020-27428
1Mit
1Scratch Svg Renderer
Jun 17, 2026
Jan 6, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file.
CVE-2020-23986
1Github Readme Stats Project
1Github Readme Stats
Jun 17, 2026
Jan 6, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Github Read Me Stats commit 3c7220e4f7144f6cb068fd433c774f6db47ccb95 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the function renderError.
CVE-2022-22109
1Daybydaycrm
1Daybyday Crm
Jun 17, 2026
Jan 5, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are e...Show more
In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks.Show less
CVE-2021-31589
1Beyondtrust
1Appliance Base Software
Jun 17, 2026
Jan 5, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Software version 6.0.1 and older, which allows the injection of unauthenticated, specially-crafted web...Show more
A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Software version 6.0.1 and older, which allows the injection of unauthenticated, specially-crafted web requests without proper sanitization.Show less
CVE-2022-21650
1Convos
1Convos
Jun 17, 2026
Jan 4, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension...Show more
Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after uploading a file the XSS attack is triggered upon a user viewing the file. Through this vulnerability, an attacker is capable to execute malicious scripts. Users are advised to update as soon as possible.Show less