Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,436)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-26916 1Nopcommerce 1Nopcommerce Jun 17, 2026 Feb 8, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML through the Filters/CheckDiscountCouponAttribute.cs discountcode parameter.
CVE-2020-13947 2Apache Oracle 3Activemq Communications Session Report ManagerCommunications Session Route Manager Jun 17, 2026 Feb 8, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.
CVE-2021-22122 1Fortinet 1Fortiweb Jun 17, 2026 Feb 8, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to perform a reflected cross site script...Show more An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload in different vulnerable API end-points.Show less
CVE-2020-26052 1Phpgurukul 1Online Marriage Registration System Jun 17, 2026 Feb 8, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Online Marriage Registration System 1.0 is affected by stored cross-site scripting (XSS) vulnerabilities in multiple parameters.
CVE-2021-21434 1Otrs 1Survey Jun 17, 2026 Feb 8, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Survey administrator can craft a survey in such way that malicious code can be executed in the agent interface (i.e. another agent who wants to make changes in the survey). This issue affects: OTRS AG Survey 6.0.x versio...Show more Survey administrator can craft a survey in such way that malicious code can be executed in the agent interface (i.e. another agent who wants to make changes in the survey). This issue affects: OTRS AG Survey 6.0.x version 6.0.20 and prior versions; 7.0.x version 7.0.19 and prior versions.Show less
CVE-2021-26723 1Jenzabar 1Jenzabar Jun 17, 2026 Feb 6, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Jenzabar 9.2.x through 9.2.2 allows /ics?tool=search&query= XSS.
CVE-2021-22499 1Microfocus 1Application Performance Management Jun 17, 2026 Feb 6, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Persistent Cross-Site scripting vulnerability in Micro Focus Application Performance Management product, affecting versions 9.40, 9.50 and 9.51. The vulnerability could allow persistent XSS attack.
CVE-2021-26722 1Linkedin 1Oncall Jun 17, 2026 Feb 5, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar.
CVE-2021-3258 1Qa Themes 1Q2a Ultimate Seo Jun 17, 2026 Feb 5, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting (XSS), which may lead to arbitrary remote code execution.
CVE-2020-18737 1Typora 1Typora Jun 17, 2026 Feb 5, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Typora 0.9.67. There is an XSS vulnerability that causes Remote Code Execution.
CVE-2021-3333 1Opmantek 1Open Audit Jun 17, 2026 Feb 5, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Opmantek Open-AudIT 4.0.1 is affected by cross-site scripting (XSS). When outputting SQL statements for debugging, a maliciously crafted query can trigger an XSS attack. This attack only succeeds if the user is already l...Show more Opmantek Open-AudIT 4.0.1 is affected by cross-site scripting (XSS). When outputting SQL statements for debugging, a maliciously crafted query can trigger an XSS attack. This attack only succeeds if the user is already logged in to Open-AudIT before they click the malicious link.Show less
CVE-2021-26710 1Redwood 1Report2web Jun 17, 2026 Feb 5, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) issue in the login panel in Redwood Report2Web 4.3.4.5 and 4.5.3 allows remote attackers to inject JavaScript via the signIn.do urll parameter.
CVE-2020-4825 1Ibm 1Api Connect Jun 17, 2026 Feb 4, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the inten...Show more IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 189839.Show less
CVE-2021-26023 1Nagios 1Favorites Jun 17, 2026 Feb 3, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS.
CVE-2020-9390 1Squaredup 1Squaredup Jun 17, 2026 Feb 3, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SquaredUp allowed Stored XSS before version 4.6.0. A user was able to create a dashboard that executed malicious content in iframe or by uploading an SVG that contained a script.
CVE-2020-18724 1Altn 1Mdaemon Webmail Jun 17, 2026 Feb 3, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes code and perform a XSS attack while opening a contact list.
CVE-2020-18723 1Altn 1Mdaemon Webmail Jun 17, 2026 Feb 3, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities.
CVE-2019-16268 1Zohocorp 1Manageengine Remote Access Plus Jun 17, 2026 Feb 3, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen.
CVE-2020-8294 1Nextcloud 1Nextcloud Server Jun 17, 2026 Feb 3, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format.
CVE-2021-25773 1Jetbrains 1Teamcity Jun 17, 2026 Feb 3, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.

Previous 1...166816691670...2422 Next