Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,358)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-20447 1Ibm 6Engineering Insights Engineering Lifecycle ManagementEngineering Requirements Quality Assistant On Premises+3 more Jun 17, 2026 Mar 30, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to creden...Show more IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196623.Show less
CVE-2021-20352 1Ibm 6Engineering Insights Engineering Lifecycle ManagementEngineering Requirements Quality Assistant On Premises+3 more Jun 17, 2026 Mar 30, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to creden...Show more IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194710.Show less
CVE-2021-21398 1Prestashop 1Prestashop Jun 17, 2026 Mar 30, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type DataColumn is badly used. The problem is fixed in 1.7.7.3
CVE-2021-28935 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Mar 30, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field.
CVE-2021-21635 1Jenkins 1Rest List Parameter Jun 17, 2026 Mar 30, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Con...Show more Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.Show less
CVE-2021-21630 1Jenkins 1Extra Columns Jun 17, 2026 Mar 30, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure pe...Show more Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.Show less
CVE-2021-21628 1Jenkins 1Build With Parameters Jun 17, 2026 Mar 30, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission...Show more Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.Show less
CVE-2020-20545 1Seeyon 1G6 Government Collaborative System Jun 17, 2026 Mar 30, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-Site Scripting (XSS) vulnerability in Zhiyuan G6 Government Collaboration System V6.1SP1, via the 'method' parameter to 'seeyon/hrSalary.do'.
CVE-2020-19643 1Insma 1Wifi Mini Spy 1080p Hd Security Ip Camera Firmware Jun 17, 2026 Mar 30, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross Site Scripting (XSS) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in the FTP settings page to the "goform/formSetFtpCfg" settings page.
CVE-2021-25161 2Arubanetworks Siemens 2Instant Scalance W1750d Firmware Jun 17, 2026 Mar 30, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below;...Show more A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.Show less
CVE-2021-29267 1Sherlockim 1Sherlockim Jun 17, 2026 Mar 29, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Sherlock SherlockIM through 2021-03-29 allows Cross Site Scripting (XSS) by leveraging the api/Files/Attachment URI to attack help-desk staff via the chatbot feature.
CVE-2021-29274 1Redmine 1Redmine Jun 17, 2026 Mar 29, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.
CVE-2021-29272 1Microco 1Bluemonday Jun 17, 2026 Mar 27, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism against the "script" string.
CVE-2021-29271 1Remark42 1Remark42 Jun 17, 2026 Mar 27, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 remark42 before 1.6.1 allows XSS, as demonstrated by "Locator: Locator{URL:" followed by an XSS payload. This is related to backend/app/store/comment.go and backend/app/store/service/service.go.
CVE-2021-21333 2Fedoraproject Matrix 2Fedora Synapse Jun 17, 2026 Mar 26, 2021 N/A· v4 6.1 MEDIUM· v3 2.6 LOW· v2 Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails se...Show more Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0.Show less
CVE-2021-21332 2Fedoraproject Matrix 2Fedora Synapse Jun 17, 2026 Mar 26, 2021 N/A· v4 8.2 HIGH· v3 4.3 MEDIUM· v2 Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoin...Show more Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.Show less
CVE-2021-22886 1Rocketchat 1Rocket.chat Jun 17, 2026 Mar 26, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to a...Show more Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.Show less
CVE-2020-35856 1Solarwinds 1Orion Platform Jun 17, 2026 Mar 26, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page.
CVE-2020-19626 1Craftcms 1Craft Cms Jun 17, 2026 Mar 26, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.
CVE-2020-25840 1Microfocus 1Access Manager Jun 17, 2026 Mar 26, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-Site scripting vulnerability in Micro Focus Access Manager product, affects all version prior to version 5.0. The vulnerability could cause configuration destruction.

Previous 1...165116521653...2418 Next