Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,187)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-25838 1Minthcm 1Minthcm Jun 17, 2026 Apr 26, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Import function in MintHCM RELEASE 3.0.8 allows an attacker to execute a cross-site scripting (XSS) payload in file-upload.
CVE-2021-28079 1Jamovi 1Jamovi Jun 17, 2026 Apr 26, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Jamovi <=1.6.18 is affected by a cross-site scripting (XSS) vulnerability. The column-name is vulnerable to XSS in the ElectronJS Framework. An attacker can make a .omv (Jamovi) document containing a payload. When opened...Show more Jamovi <=1.6.18 is affected by a cross-site scripting (XSS) vulnerability. The column-name is vulnerable to XSS in the ElectronJS Framework. An attacker can make a .omv (Jamovi) document containing a payload. When opened by victim, the payload is triggered.Show less
CVE-2021-31803 1Cpanel 1Cpanel Jun 17, 2026 Apr 26, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).
CVE-2021-20710 1Aterm 1Wg2600hs Firmware Jun 17, 2026 Apr 26, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.5.1 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
CVE-2021-20680 1Nec 17Aterm W1200ex Ms Firmware Aterm W1200ex FirmwareAterm W300p Firmware+14 more Jun 17, 2026 Apr 26, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in NEC Aterm devices (Aterm WG1900HP2 firmware Ver.1.3.1 and earlier, Aterm WG1900HP firmware Ver.2.5.1 and earlier, Aterm WG1800HP4 firmware Ver.1.3.1 and earlier, Aterm WG1800HP3 firm...Show more Cross-site scripting vulnerability in NEC Aterm devices (Aterm WG1900HP2 firmware Ver.1.3.1 and earlier, Aterm WG1900HP firmware Ver.2.5.1 and earlier, Aterm WG1800HP4 firmware Ver.1.3.1 and earlier, Aterm WG1800HP3 firmware Ver.1.5.1 and earlier, Aterm WG1200HS2 firmware Ver.2.5.0 and earlier, Aterm WG1200HP3 firmware Ver.1.3.1 and earlier, Aterm WG1200HP2 firmware Ver.2.5.0 and earlier, Aterm W1200EX firmware Ver.1.3.1 and earlier, Aterm W1200EX-MS firmware Ver.1.3.1 and earlier, Aterm WG1200HS firmware all versions Aterm WG1200HP firmware all versions Aterm WF800HP firmware all versions Aterm WF300HP2 firmware all versions Aterm WR8165N firmware all versions Aterm W500P firmware all versions, and Aterm W300P firmware all versions) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.Show less
CVE-2021-31761 1Webmin 1Webmin Jun 17, 2026 Apr 25, 2021 N/A· v4 9.6 CRITICAL· v3 6.8 MEDIUM· v2 Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature.
CVE-2021-31712 1React Draft Wysiwyg Project 1React Draft Wysiwyg Jun 17, 2026 Apr 24, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is shared across users, leading to XSS.
CVE-2021-31794 1Directum 1Directum Jun 17, 2026 Apr 24, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Settings.aspx?view=About in Directum 5.8.2 allows XSS via the HTTP User-Agent header.
CVE-2021-31583 1Sipwise 1Next Generation Communication Platform Jun 17, 2026 Apr 23, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS vulnerabilities when input passed via several parameters to several scripts is...Show more Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user: Stored XSS in callforward/time/set/save (POST tsetname); Reflected XSS in addressbook (GET filter); Stored XSS in addressbook/save (POST firstname, lastname, company); and Reflected XSS in statistics/versions (GET lang).Show less
CVE-2020-17542 1Dotcms 1Dotcms Jun 17, 2026 Apr 23, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross Site Scripting (XSS) in dotCMS v5.1.5 allows remote attackers to execute arbitrary code by injecting a malicious payload into the "Task Detail" comment window of the "/dotAdmin/#/c/workflow" component.
CVE-2019-25028 1Vaadin 1Vaadin Jun 17, 2026 Apr 23, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject mali...Show more Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vectorShow less
CVE-2019-25027 1Vaadin 2Flow Vaadin Jun 17, 2026 Apr 23, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attack...Show more Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URLShow less
CVE-2021-22199 1Gitlab 1Gitlab Jun 17, 2026 Apr 22, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue has been discovered in GitLab affecting all versions starting with 12.9. GitLab was vulnerable to a stored XSS if scoped labels were used.
CVE-2021-24241 1Advancedcustomfields 1Advanced Custom Fields Jun 17, 2026 Apr 22, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings p...Show more The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.Show less
CVE-2021-24239 1Genetechsolutions 1Pie Register Jun 17, 2026 Apr 22, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation C...Show more The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.Show less
CVE-2021-24237 1Purethemes 2Findeo Realteo Jun 17, 2026 Apr 22, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius. _bedrooms and _bathrooms GET parameters before outputting them in its properties page, lea...Show more The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius. _bedrooms and _bathrooms GET parameters before outputting them in its properties page, leading to an unauthenticated reflected Cross-Site Scripting issue.Show less
CVE-2021-24235 1Boostifythemes 1Goto Jun 17, 2026 Apr 22, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Goto WordPress theme before 2.0 does not sanitise the keywords and start_date GET parameter on its Tour List page, leading to an unauthenticated reflected Cross-Site Scripting issue.
CVE-2021-24234 1Ivorysearch 1Ivory Search Jun 17, 2026 Apr 22, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious...Show more The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to conduct the attack.Show less
CVE-2021-24233 1Boxystudio 1Cooked Jun 17, 2026 Apr 22, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Cooked Pro WordPress plugin before 1.7.5.6 was affected by unauthenticated reflected Cross-Site Scripting issues, due to improper sanitisation of user input while being output back in pages as an arbitrary attribute.
CVE-2021-24232 1Elbtide 1Advanced Booking Calendar Jun 17, 2026 Apr 22, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue

Previous 1...163416351636...2410 Next