← Back
CWE-79

48,349 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,349)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-30056
1Eng
1Knowage
Jun 17, 2026
Apr 5, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in /restful-services/publish via the 'EXEC_FROM' parameter that can lead to data leakage.
CVE-2021-29996
1Marktext
1Marktext
Jun 17, 2026
Apr 5, 2021
N/A· v4
9.6 CRITICAL· v3
6.8 MEDIUM· v2
Mark Text through 0.16.3 allows attackers arbitrary command execution. This could lead to Remote Code Execution (RCE) by opening .md files containing a mutation Cross Site Scripting (XSS) payload.
CVE-2021-30074
1Docsifyjs
1Docsify
Jun 17, 2026
Apr 2, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
docsify 4.12.1 is affected by Cross Site Scripting (XSS) because the search component does not appropriately encode Code Blocks and mishandles the " character.
CVE-2021-30125
1Jamf
1Jamf
Jun 17, 2026
Apr 2, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Jamf Pro before 10.28.0 allows XSS related to inventory history, aka PI-009376.
CVE-2021-29661
1Softing
1Opc Toolbox
Jun 17, 2026
Apr 2, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Softing AG OPC Toolbox through 4.10.1.13035 allows /en/diag_values.html Stored XSS via the ITEMLISTVALUES##ITEMID parameter, resulting in JavaScript payload injection into the trace file. This payload will then be trigge...Show more
Softing AG OPC Toolbox through 4.10.1.13035 allows /en/diag_values.html Stored XSS via the ITEMLISTVALUES##ITEMID parameter, resulting in JavaScript payload injection into the trace file. This payload will then be triggered every time an authenticated user browses the page containing it.Show less
CVE-2021-1879
1Apple
3Ipados
Iphone OsWatchos
Jun 17, 2026
Apr 2, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing maliciously crafted web content may lead to universal cross...Show more
This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing maliciously crafted web content may lead to universal cross site scripting. Apple is aware of a report that this issue may have been actively exploited..Show less
CVE-2020-9995
1Apple
1Macos Server
Jun 17, 2026
Apr 2, 2021
N/A· v4
6.1 MEDIUM· v3
5.8 MEDIUM· v2
An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in macOS Server 5.11. Processing a maliciously crafted URL may lead to an open redirect or cross site...Show more
An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in macOS Server 5.11. Processing a maliciously crafted URL may lead to an open redirect or cross site scripting.Show less
CVE-2021-22196
1Gitlab
1Gitlab
Jun 17, 2026
Apr 2, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge request via a specifically crafted branch name.
CVE-2021-29011
1Dmasoftlab
1Dma Radius Manager
Jun 17, 2026
Apr 2, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
DMA Softlab Radius Manager 4.4.0 is affected by Cross Site Scripting (XSS) via the description, name, or address field (under admin.php).
CVE-2021-25894
1Magnolia Cms
1Magnolia Cms
Jun 17, 2026
Apr 2, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the /magnoliaPublic/travel/members/login.html mgnlUserId parameter.
CVE-2021-25893
1Magnolia Cms
1Magnolia Cms
Jun 17, 2026
Apr 2, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the setText parameter of /magnoliaAuthor/.magnolia/.
CVE-2021-30003
1Nokia
1G 120w F Firmware
Jun 17, 2026
Apr 2, 2021
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
An issue was discovered on Nokia G-120W-F 3FE46606AGAB91 devices. There is Stored XSS in the administrative interface via urlfilter.cgi?add url_address.
CVE-2021-23925
1Devolutions
1Devolutions Server
Jun 17, 2026
Apr 1, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Devolutions Server before 2020.3. There is a cross-site scripting (XSS) vulnerability in entries of type Document.
CVE-2021-23922
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Apr 1, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in Devolutions Remote Desktop Manager before 2020.2.12. There is a cross-site scripting (XSS) vulnerability in webviews.
CVE-2021-28047
1Devolutions
1Remote Desktop Manager
Jun 17, 2026
Apr 1, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross-Site Scripting (XSS) in Administrative Reports in Devolutions Remote Desktop Manager before 2021.1 allows remote authenticated users to inject arbitrary web script or HTML via multiple input fields.
CVE-2020-19619
1Mblog Project
1Mblog
Jun 17, 2026
Apr 1, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile.
CVE-2020-19618
1Mblog Project
1Mblog
Jun 17, 2026
Apr 1, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.
CVE-2021-26580
1Hpe
1Integrated Lights Out Amplifier
Jun 17, 2026
Apr 1, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A potential security vulnerability has been identified in HPE iLO Amplifier Pack. The vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS). HPE has provided the following software update to resol...Show more
A potential security vulnerability has been identified in HPE iLO Amplifier Pack. The vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS). HPE has provided the following software update to resolve the vulnerability in HPE iLO Amplifier Pack: HPE iLO Amplifier Pack 1.95 or later.Show less
CVE-2020-19617
1Mblog Project
1Mblog
Jun 17, 2026
Apr 1, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.
CVE-2020-19616
1Mblog Project
1Mblog
Jun 17, 2026
Apr 1, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.