← Back
CWE-79

47,722 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (47,722)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-28968
1Draytek
13Vigorap 1000c Firmware
Vigorap 700 FirmwareVigorap 710 Firmware+10 more
Jun 17, 2026
Oct 22, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML vi...Show more
Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field.Show less
CVE-2020-28961
1Perfexcrm
1Perfex Crm
Jun 17, 2026
Oct 22, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Perfex CRM v2.4.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component ./clients/client via the company name parameter.
CVE-2020-28957
1Froxlor
1Froxlor
Jun 17, 2026
Oct 22, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the name, firstname, or usern...Show more
Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the name, firstname, or username input fields.Show less
CVE-2020-28956
1Sugarcrm
1Sugarcrm
Jun 17, 2026
Oct 22, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alterna...Show more
Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields.Show less
CVE-2020-28955
1Sugarcrm
1Sugarcrm
Jun 17, 2026
Oct 22, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in t...Show more
SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the First Name or Last Name input fields.Show less
CVE-2020-23055
1Lancom Systems
1Lcos
Jun 17, 2026
Oct 22, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
ANCOM WLAN Controller (Wireless Series & Hotspot) WLC-1000 & WLC-4006 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the /authen/start/ module via the userid and password parameters.
CVE-2020-23054
1User Agent Switcher And Manager Project
1User Agent Switcher And Manager
Jun 17, 2026
Oct 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A cross-site scripting (XSS) vulnerability in NSK User Agent String Switcher Service v0.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the user agent input field.
CVE-2020-23052
1Catalyst
1Mahara
Jun 17, 2026
Oct 22, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Catalyst IT Ltd Mahara CMS v19.10.2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component groupfiles.php via the Number (Nombre) and Description (Descripción) parameters.
CVE-2020-23051
1User Registration & Login And User Management System With Admin Panel Project
1User Registration & Login And User Management System With Admin Panel
Jun 17, 2026
Oct 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Phpgurukul User Registration & User Management System v2.0 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilities via the firstname and lastname parameters of the registration form & loginsy...Show more
Phpgurukul User Registration & User Management System v2.0 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilities via the firstname and lastname parameters of the registration form & loginsystem input fields.Show less
CVE-2020-23049
1Fork Cms
1Fork Cms
Jun 17, 2026
Oct 22, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the `Displayname` field when using the `Add`, `Edit` or `Register' functions. This vulnerability allows at...Show more
Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the `Displayname` field when using the `Add`, `Edit` or `Register' functions. This vulnerability allows attackers to execute arbitrary web scripts or HTML.Show less
CVE-2020-23048
1Seeddms
1Seeddms
Jun 17, 2026
Oct 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the component AddEvent.php via the name and comment parameters.
CVE-2020-23047
1Macs Cms Project
1Macs Cms
Jun 17, 2026
Oct 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a cross-site scripting (XSS) vulnerability in the search input field of the search module.
CVE-2020-23046
1Dedecms
1Dedecms
Jun 17, 2026
Oct 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tpl.php via the `filename`, `mid`, `userid`, and `templet' parameters.
CVE-2020-23044
1Dedecms
1Dedecms
Jun 17, 2026
Oct 22, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_pic_view.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum...Show more
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_pic_view.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters.Show less
CVE-2020-23042
1Dropouts
1Super Backup
Jun 17, 2026
Oct 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Dropouts Technologies LLP Super Backup v2.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability in the path parameter of the `list` and `download` module. This vulnerability allows attackers to execute...Show more
Dropouts Technologies LLP Super Backup v2.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability in the path parameter of the `list` and `download` module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted GET request.Show less
CVE-2020-23041
1Dropouts
1Air Share
Jun 17, 2026
Oct 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the path parameter of the `list` and `download` exception-handling. This vulnerability allows attackers to...Show more
Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the path parameter of the `list` and `download` exception-handling. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted GET request.Show less
CVE-2020-23039
1Newsoftwares
1Folder Lock
Jun 17, 2026
Oct 22, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Folder Lock v3.4.5 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Create Folder function under the 'create' module. This vulnerability allows attackers to execute arbitrary web scripts...Show more
Folder Lock v3.4.5 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Create Folder function under the 'create' module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload as a path or folder name.Show less
CVE-2021-29835
1Ibm
1Business Automation Workflow
Jun 17, 2026
Oct 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...Show more
IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204833.Show less
CVE-2021-42534
1Trane
1Tracer Sc Firmware
Jun 17, 2026
Oct 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The affected product’s web application does not properly neutralize the input during webpage generation, which could allow an attacker to inject code in the input forms.
CVE-2021-41747
1Csdn
1Csdn App
Jun 17, 2026
Oct 22, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-Site Scripting (XSS) vulnerability exists in Csdn APP 4.10.0, which can be exploited by attackers to obtain sensitive information such as user cookies.