Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,335)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-1408 1Cisco 1Unified Communications Manager Jun 17, 2026 Apr 8, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Com...Show more Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against an interface user. These vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by persuading an interface user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.Show less
CVE-2021-1407 1Cisco 1Unified Communications Manager Jun 17, 2026 Apr 8, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Com...Show more Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against an interface user. These vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by persuading an interface user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.Show less
CVE-2021-1380 1Cisco 3Unified Communications Manager Unified Communications Manager Im & Presence ServiceUnity Connection Jun 17, 2026 Apr 8, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Com...Show more Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against an interface user. These vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by persuading an interface user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.Show less
CVE-2020-24135 1Wcms 1Wcms Jun 17, 2026 Apr 7, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Wcms 0.3.2, which allows remote attackers to inject arbitrary web script and HTML via the type parameter to wex/cssjs.php.
CVE-2020-24138 1Wcms 1Wcms Jun 17, 2026 Apr 7, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross Site Scripting (XSS) vulnerability in wcms 0.3.2 allows remote attackers to inject arbitrary web script and HTML via the pagename parameter to wex/html.php.
CVE-2021-20691 1Yomi Search Project 1Yomi Search Jun 17, 2026 Apr 7, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVE-2021-20690 1Yomi Search Project 1Yomi Search Jun 17, 2026 Apr 7, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVE-2021-20689 1Yomi Search Project 1Yomi Search Jun 17, 2026 Apr 7, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in Yomi-Search Ver4.22 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVE-2021-20688 1Click Ranker 1Click Ranker Jun 17, 2026 Apr 7, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in Click Ranker Ver.3.5 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVE-2021-20686 1Daifukuya 1Kagemai Jun 17, 2026 Apr 7, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVE-2021-20685 1Daifukuya 1Kagemai Jun 17, 2026 Apr 7, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVE-2021-20684 1Magazinegerz Project 1Magazinegerz Jun 17, 2026 Apr 7, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in MagazinegerZ v.1.01 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVE-2021-22157 1Proofpoint 1Insider Threat Management Jun 17, 2026 Apr 6, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.11.1 allows stored XSS.
CVE-2020-13418 1Openiam 1Openiam Jun 17, 2026 Apr 6, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 OpenIAM before 4.2.0.3 allows XSS in the Add New User feature.
CVE-2021-30146 1Seafile 1Seafile Jun 17, 2026 Apr 6, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality."
CVE-2021-30140 1Liquidfiles 1Liquidfiles Jun 17, 2026 Apr 6, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has no extension and contains malicious HTML / JavaScript content (such as SVG with...Show more LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has no extension and contains malicious HTML / JavaScript content (such as SVG with HTML content), the payload is executed upon a click. This is fixed in 3.5.Show less
CVE-2020-36307 2Debian Redmine 2Debian Linux Redmine Jun 17, 2026 Apr 6, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links.
CVE-2020-36306 2Debian Redmine 2Debian Linux Redmine Jun 17, 2026 Apr 6, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field.
CVE-2021-30157 3Debian FedoraprojectMediawiki 3Debian Linux FedoraMediawiki Jun 17, 2026 Apr 6, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist, some of the rcfilters-filter-* label messages...Show more An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist, some of the rcfilters-filter-* label messages are output in HTML unescaped, leading to XSS.Show less
CVE-2021-30154 3Debian FedoraprojectMediawiki 3Debian Linux FedoraMediawiki Jun 17, 2026 Apr 6, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS.

Previous 1...164616471648...2417 Next