Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,436)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-27369 1Monicahq 1Monica Jun 17, 2026 Feb 22, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The Contact page in Monica 2.19.1 allows stored XSS via the Middle Name field.
CVE-2021-27368 1Monicahq 1Monica Jun 17, 2026 Feb 22, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The Contact page in Monica 2.19.1 allows stored XSS via the First Name field.
CVE-2020-19762 1Carrier 1Webctrl System Jun 17, 2026 Feb 22, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Automated Logic Corporation (ALC) WebCTRL System 6.5 and prior allows remote attackers to execute any JavaScript code via a XSS payload for the first parameter in a GET request.
CVE-2020-35664 1Acronis 1Cyber Protect Jun 17, 2026 Feb 22, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. There is cross-site scripting (XSS) in the console.
CVE-2020-35571 1Mantisbt 1Mantisbt Jun 17, 2026 Feb 22, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in MantisBT through 2.24.3. In the helper_ensure_confirmed call in manage_custom_field_update.php, the custom field name is not sanitized. This may be problematic depending on CSP settings.
CVE-2021-26716 1Openenergymonitor 1Emoncms Jun 17, 2026 Feb 21, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Modules/input/Views/schedule.php in Emoncms through 10.2.7 allows XSS via the node parameter.
CVE-2021-26544 1Apache 1Livy Jun 17, 2026 Feb 20, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with th...Show more Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.Show less
CVE-2021-27214 1Zohocorp 1Manageengine Adselfservice Plus Jun 17, 2026 Feb 19, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cr...Show more A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting (XSS) attack against the administrative interface via an HTTP request, a different vulnerability than CVE-2019-3905.Show less
CVE-2021-23342 1Docsifyjs 1Docsify Jun 17, 2026 Feb 19, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTM...Show more This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTML code on the main page is sanitized, but this sanitization is not taking place in the sidebar. 2) The isURL external check can be bypassed by inserting more “////” charactersShow less
CVE-2021-3210 1Bloodhound Project 1Bloodhound Jun 17, 2026 Feb 19, 2021 N/A· v4 9.6 CRITICAL· v3 9.3 HIGH· v2 components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound <= 4.0.1 allows remote attackers to execute arbitrary system commands when the victim imports a malicious data file containing JavaScript in the objectI...Show more components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound <= 4.0.1 allows remote attackers to execute arbitrary system commands when the victim imports a malicious data file containing JavaScript in the objectId parameter.Show less
CVE-2021-26746 1Chamilo 1Chamilo Jun 17, 2026 Feb 19, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI.
CVE-2021-27403 1Asus 1Askey Rtf8115vw Firmware Jun 17, 2026 Feb 19, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow cgi-bin/te_acceso_router.cgi curWebPage XSS.
CVE-2020-35592 1Pi Hole 1Pi Hole Jun 17, 2026 Feb 18, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cr...Show more Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the session cookie.Show less
CVE-2021-3271 1Pressbooks 1Pressbooks Jun 17, 2026 Feb 18, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 PressBooks 5.17.3 contains a cross-site scripting (XSS). Stored XSS can be submitted via the Book Info's Long Description Body, and all actions to open or preview the books page will result in the triggering the stored X...Show more PressBooks 5.17.3 contains a cross-site scripting (XSS). Stored XSS can be submitted via the Book Info's Long Description Body, and all actions to open or preview the books page will result in the triggering the stored XSS.Show less
CVE-2021-20446 1Ibm 1Maximo For Civil Infrastructure Jun 17, 2026 Feb 18, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadi...Show more IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196622.Show less
CVE-2021-20444 1Ibm 1Maximo For Civil Infrastructure Jun 17, 2026 Feb 18, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadi...Show more IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196620.Show less
CVE-2020-4933 1Ibm 1Jazz Reporting Service Jun 17, 2026 Feb 18, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality p...Show more IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191751.Show less
CVE-2021-1351 1Cisco 1Webex Meetings Jun 17, 2026 Feb 17, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in the web-based interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of the affected...Show more A vulnerability in the web-based interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of the affected service. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected service. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.Show less
CVE-2020-2502 1Qnap 1Photo Station Jun 17, 2026 Feb 17, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. Photo Station 6.0.11 an...Show more This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. Photo Station 6.0.11 and laterShow less
CVE-2021-20071 1Racom 1M!dge Firmware Jun 17, 2026 Feb 16, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via the sms.php dialogs.

Previous 1...166516661667...2422 Next