Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,436)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-23347 1Argoproj 1Argo Cd Jun 17, 2026 Mar 3, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message...Show more The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.Show less
CVE-2020-12530 1Mbconnectline 2Mbconnect24 Mymbconnect24 Jun 17, 2026 Mar 2, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in the redirect.php allowing an attacker to inject code via a get parameter.
CVE-2021-21258 1Glpi Project 1Glpi Jun 17, 2026 Mar 2, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI from version 9.5.0 and before version 9.5.4, there is a cross-sit...Show more GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI from version 9.5.0 and before version 9.5.4, there is a cross-site scripting injection vulnerability when using ajax/kanban.php. This is fixed in version 9.5.4.Show less
CVE-2020-23518 1Ultimatekode 1Neo Billing Jun 17, 2026 Mar 2, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross Site Scripting (XSS) vulnerability in UltimateKode Neo Billing - Accounting, Invoicing And CRM Software up to version 3.5 which allows remote attackers to inject arbitrary web script or HTML.
CVE-2020-25902 1Blackboard 1Collaborate Ultra Jun 17, 2026 Mar 2, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Blackboard Collaborate Ultra 20.02 is affected by a cross-site scripting (XSS) vulnerability. The XSS payload will execute on the class room, which leads to stealing cookies from users who join the class. NOTE: Third-par...Show more Blackboard Collaborate Ultra 20.02 is affected by a cross-site scripting (XSS) vulnerability. The XSS payload will execute on the class room, which leads to stealing cookies from users who join the class. NOTE: Third-parties dispute the validity of this entry as a possible false positive during researchShow less
CVE-2020-1936 1Apache 1Ambari Jun 17, 2026 Mar 2, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4.
CVE-2021-27888 1Zend 1Zendto Jun 17, 2026 Mar 2, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters.
CVE-2021-27731 1Accellion 1Fta Jun 17, 2026 Mar 2, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed version is FTA_9_12_444 and later.
CVE-2021-26702 1Eprints 1Eprints Jun 17, 2026 Mar 1, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/dataset_dictionary URI.
CVE-2021-26475 1Eprints 1Eprints Jun 17, 2026 Mar 1, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI.
CVE-2021-27318 1Doctor Appointment System Project 1Doctor Appointment System Jun 17, 2026 Mar 1, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web script or HTML via the lastname parameter.
CVE-2021-27317 1Doctor Appointment System Project 1Doctor Appointment System Jun 17, 2026 Mar 1, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross Site Scripting (XSS) vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web script or HTML via the comment parameter.
CVE-2021-21515 1Dell 1Emc Sourceone Jun 17, 2026 Mar 1, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Dell EMC SourceOne, versions 7.2SP10 and prior, contain a Stored Cross-Site Scripting vulnerability. A remote low privileged attacker may potentially exploit this vulnerability, to hijack user sessions or to trick a vict...Show more Dell EMC SourceOne, versions 7.2SP10 and prior, contain a Stored Cross-Site Scripting vulnerability. A remote low privileged attacker may potentially exploit this vulnerability, to hijack user sessions or to trick a victim application user to unknowingly send arbitrary requests to the server.Show less
CVE-2021-3151 1I Doit 1I Doit Jun 17, 2026 Feb 27, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE, SM2__C__MONITORING__CO...Show more i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE, SM2__C__MONITORING__CONFIG__TITLE, C__MONITORING__CONFIG__PATH, SM2__C__MONITORING__CONFIG__PATH, C__MONITORING__CONFIG__ADDRESS, or SM2__C__MONITORING__CONFIG__ADDRESS.Show less
CVE-2021-3010 1Opentext 1Content Server Jun 17, 2026 Feb 26, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 There are multiple persistent cross-site scripting (XSS) vulnerabilities in the web interface of OpenText Content Server Version 20.3. The application allows a remote attacker to introduce arbitrary JavaScript by craftin...Show more There are multiple persistent cross-site scripting (XSS) vulnerabilities in the web interface of OpenText Content Server Version 20.3. The application allows a remote attacker to introduce arbitrary JavaScript by crafting malicious form values that are later not sanitized.Show less
CVE-2021-26903 1Isida 1Retriever Jun 17, 2026 Feb 26, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 LMA ISIDA Retriever 5.2 is vulnerable to XSS via query['text'].
CVE-2019-18944 1Microfocus 1Solutions Business Manager Jun 17, 2026 Feb 26, 2021 N/A· v4 4.8 MEDIUM· v3 2.3 LOW· v2 Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS.
CVE-2019-18942 1Microfocus 1Solutions Business Manager Jun 17, 2026 Feb 26, 2021 N/A· v4 4.8 MEDIUM· v3 2.3 LOW· v2 Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to stored XSS. The application reflects previously stored user input without encoding.
CVE-2021-23959 1Mozilla 1Firefox Jun 17, 2026 Feb 26, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar. Note: This issue only affected Firefox for Android. Other operating systems are unaffected....Show more An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 85.Show less
CVE-2021-1724 1Microsoft 2Dynamics 365 Business Central Dynamics Nav Jun 17, 2026 Feb 25, 2021 N/A· v4 4.8 MEDIUM· v3 2.3 LOW· v2 Microsoft Dynamics Business Central Cross-site Scripting Vulnerability

Previous 1...166316641665...2422 Next