← Back
CWE-79

48,446 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,446)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-3333
1Opmantek
1Open Audit
Jun 17, 2026
Feb 5, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Opmantek Open-AudIT 4.0.1 is affected by cross-site scripting (XSS). When outputting SQL statements for debugging, a maliciously crafted query can trigger an XSS attack. This attack only succeeds if the user is already l...Show more
Opmantek Open-AudIT 4.0.1 is affected by cross-site scripting (XSS). When outputting SQL statements for debugging, a maliciously crafted query can trigger an XSS attack. This attack only succeeds if the user is already logged in to Open-AudIT before they click the malicious link.Show less
CVE-2021-26710
1Redwood
1Report2web
Jun 17, 2026
Feb 5, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A cross-site scripting (XSS) issue in the login panel in Redwood Report2Web 4.3.4.5 and 4.5.3 allows remote attackers to inject JavaScript via the signIn.do urll parameter.
CVE-2020-4825
1Ibm
1Api Connect
Jun 17, 2026
Feb 4, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the inten...Show more
IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 189839.Show less
CVE-2021-26023
1Nagios
1Favorites
Jun 17, 2026
Feb 3, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS.
CVE-2020-9390
1Squaredup
1Squaredup
Jun 17, 2026
Feb 3, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
SquaredUp allowed Stored XSS before version 4.6.0. A user was able to create a dashboard that executed malicious content in iframe or by uploading an SVG that contained a script.
CVE-2020-18724
1Altn
1Mdaemon Webmail
Jun 17, 2026
Feb 3, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes code and perform a XSS attack while opening a contact list.
CVE-2020-18723
1Altn
1Mdaemon Webmail
Jun 17, 2026
Feb 3, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities.
CVE-2019-16268
1Zohocorp
1Manageengine Remote Access Plus
Jun 17, 2026
Feb 3, 2021
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen.
CVE-2020-8294
1Nextcloud
1Nextcloud Server
Jun 17, 2026
Feb 3, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format.
CVE-2021-25773
1Jetbrains
1Teamcity
Jun 17, 2026
Feb 3, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.
CVE-2020-35482
1Solarwinds
1Serv U
Jun 17, 2026
Feb 3, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS.
CVE-2020-28001
1Solarwinds
1Serv U
Jun 17, 2026
Feb 3, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS.
CVE-2020-29164
1Rainbowfishsoftware
1Pacsone Server
Jun 17, 2026
Feb 3, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by cross-site scripting (XSS).
CVE-2021-21043
1Adobe
1Adobe Consulting Services Commons
Jun 17, 2026
Feb 2, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly. An attacker coul...Show more
ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly. An attacker could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. Exploitation of this issue requires user interaction in order to be successful.Show less
CVE-2021-3395
1Pryaniki
1Pryaniki
Jun 17, 2026
Feb 2, 2021
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A cross-site scripting (XSS) vulnerability in Pryaniki 6.44.3 allows remote authenticated users to upload an arbitrary file. The JavaScript code will execute when someone visits the attachment.
CVE-2020-4081
1Hcltech
1Digital Experience
Jun 17, 2026
Feb 2, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS).
CVE-2021-23271
1Tibco
1Ebx
Jun 17, 2026
Feb 2, 2021
N/A· v4
8.0 HIGH· v3
6.0 MEDIUM· v2
The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) attack...Show more
The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.9.12 and below.Show less
CVE-2021-3340
1Wikindx Project
1Wikindx
Jun 17, 2026
Feb 1, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A cross-site scripting (XSS) vulnerability in many forms of Wikindx before 5.7.0 and 6.x through 6.4.0 allows remote attackers to inject arbitrary web script or HTML via the message parameter to index.php?action=initLogo...Show more
A cross-site scripting (XSS) vulnerability in many forms of Wikindx before 5.7.0 and 6.x through 6.4.0 allows remote attackers to inject arbitrary web script or HTML via the message parameter to index.php?action=initLogon or modules/admin/DELETEIMAGES.php.Show less
CVE-2020-13564
2Open Emr
Phpgacl Project
2Openemr
Phpgacl
Jun 17, 2026
Feb 1, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger th...Show more
A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability in the phpGACL template acl_id parameter.Show less
CVE-2020-13563
2Open Emr
Phpgacl Project
2Openemr
Phpgacl
Jun 17, 2026
Feb 1, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger th...Show more
A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability in the phpGACL template group_id parameter.Show less