Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,435)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-20350 1Ibm 9Doors Next Engineering Lifecycle ManagementEngineering Requirements Quality Assistant On Premises+6 more Jun 17, 2026 Mar 4, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credential...Show more IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194707.Show less
CVE-2021-20340 1Ibm 9Doors Next Engineering Lifecycle ManagementEngineering Requirements Quality Assistant On Premises+6 more Jun 17, 2026 Mar 4, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credential...Show more IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194451.Show less
CVE-2020-4975 1Ibm 9Doors Next Engineering Lifecycle ManagementEngineering Requirements Quality Assistant On Premises+6 more Jun 17, 2026 Mar 4, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credential...Show more IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 192435.Show less
CVE-2020-4866 1Ibm 9Doors Next Engineering Lifecycle ManagementEngineering Requirements Quality Assistant On Premises+6 more Jun 17, 2026 Mar 4, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credential...Show more IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190742.Show less
CVE-2020-4863 1Ibm 9Doors Next Engineering Lifecycle ManagementEngineering Requirements Quality Assistant On Premises+6 more Jun 17, 2026 Mar 4, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cre...Show more IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190566.Show less
CVE-2020-4857 1Ibm 9Doors Next Engineering Lifecycle ManagementEngineering Requirements Quality Assistant On Premises+6 more Jun 17, 2026 Mar 4, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cre...Show more IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190460.Show less
CVE-2020-4856 1Ibm 9Doors Next Engineering Lifecycle ManagementEngineering Requirements Quality Assistant On Premises+6 more Jun 17, 2026 Mar 4, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cre...Show more IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190459.Show less
CVE-2021-23130 1Joomla 1Joomla Jun 17, 2026 Mar 4, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues.
CVE-2021-23129 1Joomla 1Joomla Jun 17, 2026 Mar 4, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of messages showed to users that could lead to xss issues.
CVE-2020-35328 1Courier Management System Project 1Courier Management System Jun 17, 2026 Mar 4, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Courier Management System 1.0 - 'First Name' Stored XSS
CVE-2021-22183 1Gitlab 1Gitlab Jun 17, 2026 Mar 4, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS in the epics page, which could be exploited with user interactions.
CVE-2020-24912 1Qcubed 1Qcubed Jul 9, 2026 Mar 4, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.
CVE-2021-27940 1Openark 1Orchestrator Jun 17, 2026 Mar 3, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter.
CVE-2021-21314 1Glpi Project 1Glpi Jun 17, 2026 Mar 3, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is an XSS vulnerability involving a log...Show more GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is an XSS vulnerability involving a logged in user while updating a ticket.Show less
CVE-2021-21313 1Glpi Project 1Glpi Jun 17, 2026 Mar 3, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability in the /ajax/common....Show more GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability in the /ajax/common.tabs.php endpoint, indeed, at least two parameters _target and id are not properly sanitized. Here are two payloads (due to two different exploitations depending on which parameter you act) to exploit the vulnerability:/ajax/common.tabs.php?_target=javascript:alert(document.cookie)&_itemtype=DisplayPreference&_glpi_tab=DisplayPreference$2&id=258&displaytype=Ticket (Payload triggered if you click on the button). /ajax/common.tabs.php?_target=/front/ticket.form.php&_itemtype=Ticket&_glpi_tab=Ticket$1&id=(){};(function%20(){alert(document.cookie);})();function%20a&#.Show less
CVE-2021-21312 1Glpi Project 1Glpi Jun 17, 2026 Mar 3, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability within the document...Show more GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability within the document upload function (Home > Management > Documents > Add, or /front/document.form.php endpoint), indeed one of the form field: "Web Link" is not properly sanitized and a malicious user (who has document upload rights) can use it to deliver JavaScript payload. For example if you use the following payload: " accesskey="x" onclick="alert(1)" x=", the content will be saved within the database without any control. And then once you return to the summary documents page, by clicking on the "Web Link" of the newly created file it will create a new empty tab, but on the initial tab the pop-up "1" will appear.Show less
CVE-2021-22878 2Fedoraproject Nextcloud 2Fedora Nextcloud Server Jun 17, 2026 Mar 3, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.
CVE-2021-22182 1Gitlab 1Gitlab Jun 17, 2026 Mar 3, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request.
CVE-2020-15937 1Fortinet 1Fortios Jun 17, 2026 Mar 3, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack (XSS) via the IPS and WAF logs da...Show more An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack (XSS) via the IPS and WAF logs dashboard.Show less
CVE-2021-23347 1Argoproj 1Argo Cd Jun 17, 2026 Mar 3, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message...Show more The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.Show less

Previous 1...166216631664...2422 Next