Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (47,859)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-20746 1Wordpress Popular Posts Project 1Wordpress Popular Posts Jun 17, 2026 Jun 28, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting vulnerability in WordPress Popular Posts 5.3.2 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
CVE-2021-35513 1Mermaid Project 1Mermaid Jun 17, 2026 Jun 27, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Mermaid before 8.11.0 allows XSS when the antiscript feature is used.
CVE-2021-21004 1Phoenixcontact 15Fl Nat Smn 8tx M Firmware Fl Nat Smn 8tx FirmwareFl Switch Smcs 14tx/2fx Sm Firmware+12 more Jun 17, 2026 Jun 25, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client.
CVE-2021-29677 1Ibm 1Security Verify Jun 17, 2026 Jun 25, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functio...Show more IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.Show less
CVE-2021-32702 1Auth0 1Nextjs Auth0 Jun 17, 2026 Jun 25, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including `1.4.1` are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing...Show more The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including `1.4.1` are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the `error` query parameter which is then processed by the callback handler as an error message. You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `1.4.1` or lower unless you are using custom error handling that does not return the error message in an HTML response. Upgrade to version `1.4.1` to resolve. The fix adds basic HTML escaping to the error message and it should not impact your users.Show less
CVE-2021-3314 1Oracle 1Glassfish Server Jun 17, 2026 Jun 25, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to...Show more Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. NOTE: This vulnerability only affects products that are no longer supported by the maintainerShow less
CVE-2021-35501 1Pandorafms 1Pandora Fms Jun 17, 2026 Jun 25, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console, the XSS payload will be executed.
CVE-2020-26801 1Tripplite 1Su2200rtxl2ua Firmware Jul 9, 2026 Jun 25, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A stored cross-site scripting (XSS) vulnerability was discovered in /Forms/device_vars_1 on TrippLite SU2200RTXL2Ua with firmware version 12.04.0055. This vulnerability allows authenticated attackers to obtain other user...Show more A stored cross-site scripting (XSS) vulnerability was discovered in /Forms/device_vars_1 on TrippLite SU2200RTXL2Ua with firmware version 12.04.0055. This vulnerability allows authenticated attackers to obtain other users' information via a crafted POST request.Show less
CVE-2021-35475 1Sas 1Environment Manager Jun 17, 2026 Jun 25, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when editing the Configuration Properties.
CVE-2021-32713 1Shopware 1Shopware Jun 17, 2026 Jun 24, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update...Show more Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.Show less
CVE-2020-18671 1Roundcube 1Webmail Jun 17, 2026 Jun 24, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
CVE-2020-18670 1Roundcube 1Webmail Jun 17, 2026 Jun 24, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.
CVE-2020-18668 1Webport 1Web Port Jun 17, 2026 Jun 24, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross Site Scripting (XSS) vulnerabililty in WebPort <=1.19.1 via the description parameter to script/listcalls.
CVE-2020-21783 1Ibos 1Ibos Jun 17, 2026 Jun 24, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In IBOS 4.5.4 the email function has a cross site scripting (XSS) vulnerability in emailbody[content] parameter.
CVE-2020-18664 1Webport 1Web Port Jun 17, 2026 Jun 24, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross Site Scripting (XSS) vulnerability in WebPort <=1.19.1via the connection name parameter in type-conn.
CVE-2020-18663 1Sir 1Gnuboard Jun 17, 2026 Jun 24, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the act parameter in bbs/move_update.php.
CVE-2021-33348 1Jfinal 1Jfinal Jun 17, 2026 Jun 24, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases.
CVE-2021-23398 1React Bootstrap Table Project 1React Bootstrap Table Jun 17, 2026 Jun 24, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerH...Show more All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.Show less
CVE-2020-18661 1Sir 1Gnuboard Jun 17, 2026 Jun 24, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php.
CVE-2021-29953 1Mozilla 1Firefox Jun 17, 2026 Jun 24, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in a Universal Cross-Site Scripting vulnerability. Note: This is...Show more A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in a Universal Cross-Site Scripting vulnerability. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. Further details are being temporarily withheld to allow users an opportunity to update.*. This vulnerability affects Firefox < 88.0.1 and Firefox for Android < 88.1.3.Show less

Previous 1...159715981599...2393 Next