Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,437)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-28149 1Mydbr 1Mydbr Jun 17, 2026 Mar 15, 2021 N/A· v4 9.6 CRITICAL· v3 6.8 MEDIUM· v2 myDBR 5.8.3/4262 is affected by: Cross Site Scripting (XSS). The impact is: execute arbitrary code (remote). The component is: CSRF Token. The attack vector is: CSRF token injection to XSS.
CVE-2021-27889 1Mybb 1Mybb Jun 17, 2026 Mar 15, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages.
CVE-2021-27695 1Openmaint 1Openmaint Jul 9, 2026 Mar 15, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple stored cross-site scripting (XSS) vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbitrary web script or HTML via any "Add" sections, such as Add Card Building & Floor, or others in the...Show more Multiple stored cross-site scripting (XSS) vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbitrary web script or HTML via any "Add" sections, such as Add Card Building & Floor, or others in the Name and Code Parameters.Show less
CVE-2021-26924 1Argoproj 1Argo Cd Jun 17, 2026 Mar 15, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Argo CD before 1.8.4. Browser XSS protection is not activated due to the missing XSS protection header.
CVE-2021-28378 1Gitea 1Gitea Jun 17, 2026 Mar 15, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.
CVE-2021-28161 1Eclipse 1Theia Jun 17, 2026 Mar 12, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.
CVE-2021-21080 1Adobe 1Connect Jun 17, 2026 Mar 12, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript content that may be executed wit...Show more Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript content that may be executed within the context of the victim's browser when they browse to the page containing the vulnerable field.Show less
CVE-2021-21079 1Adobe 1Connect Jun 17, 2026 Mar 12, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript content that may be executed wit...Show more Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript content that may be executed within the context of the victim's browser when they browse to the page containing the vulnerable field.Show less
CVE-2020-14988 1Bloomreach 1Experience Manager Jun 17, 2026 Mar 11, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translatio...Show more An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the upload image functionality via an SVG document containing JavaScript.Show less
CVE-2021-28088 1Impresscms 1Impresscms Jun 17, 2026 Mar 11, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbitrary web script or HTML parameters through the "Display Name" field.
CVE-2021-27679 1Batflat 1Batflat Jun 17, 2026 Mar 11, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in Navigation in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
CVE-2021-27678 1Batflat 1Batflat Jun 17, 2026 Mar 11, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in Snippets in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
CVE-2021-27677 1Batflat 1Batflat Jun 17, 2026 Mar 11, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in Galleries in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
CVE-2021-26776 1Cszcms 1Csz Cms Jun 17, 2026 Mar 11, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 CSZ CMS 1.2.9 is affected by a cross-site scripting (XSS) vulnerability in multiple pages through the field name.
CVE-2021-20336 1Ibm 1Tivoli Netcool/omnibus Webgui Jun 17, 2026 Mar 11, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lea...Show more IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.Show less
CVE-2020-35228 1Netgear 2Gs116e Firmware Jgs516pe Firmware Jun 17, 2026 Mar 10, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 A cross-site scripting (XSS) vulnerability in the administration web panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote attackers to inject arbitrary web script or HTML via the language parameter.
CVE-2020-35752 1Janobe 1Baby Care System Jun 17, 2026 Mar 10, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Baby Care System 1.0 is affected by a cross-site scripting (XSS) vulnerability in the Edit Page tab through the Post title parameter.
CVE-2021-3224 1Cszcms 1Csz Cms Jun 17, 2026 Mar 10, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A stored cross-site scripting (XSS) vulnerability in cszcms 1.2.9 exists in /admin/pages/new via the content parameter.
CVE-2020-23721 1Thedaylightstudio 1Fuel Cms Jun 17, 2026 Mar 10, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages/edit/1?lang=english.
CVE-2021-28007 1Web Based Quiz System Project 1Web Based Quiz System Jun 17, 2026 Mar 10, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in register.php through the name parameter.

Previous 1...166016611662...2422 Next