Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,472)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-3395 1Pryaniki 1Pryaniki Jun 17, 2026 Feb 2, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A cross-site scripting (XSS) vulnerability in Pryaniki 6.44.3 allows remote authenticated users to upload an arbitrary file. The JavaScript code will execute when someone visits the attachment.
CVE-2020-4081 1Hcltech 1Digital Experience Jun 17, 2026 Feb 2, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS).
CVE-2021-23271 1Tibco 1Ebx Jun 17, 2026 Feb 2, 2021 N/A· v4 8.0 HIGH· v3 6.0 MEDIUM· v2 The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) attack...Show more The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.9.12 and below.Show less
CVE-2021-3340 1Wikindx Project 1Wikindx Jun 17, 2026 Feb 1, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability in many forms of Wikindx before 5.7.0 and 6.x through 6.4.0 allows remote attackers to inject arbitrary web script or HTML via the message parameter to index.php?action=initLogo...Show more A cross-site scripting (XSS) vulnerability in many forms of Wikindx before 5.7.0 and 6.x through 6.4.0 allows remote attackers to inject arbitrary web script or HTML via the message parameter to index.php?action=initLogon or modules/admin/DELETEIMAGES.php.Show less
CVE-2020-13564 2Open Emr Phpgacl Project 2Openemr Phpgacl Jun 17, 2026 Feb 1, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger th...Show more A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability in the phpGACL template acl_id parameter.Show less
CVE-2020-13563 2Open Emr Phpgacl Project 2Openemr Phpgacl Jun 17, 2026 Feb 1, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger th...Show more A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability in the phpGACL template group_id parameter.Show less
CVE-2020-13562 2Open Emr Phpgacl Project 2Openemr Phpgacl Jun 17, 2026 Feb 1, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger th...Show more A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnaerability in the phpGACL template action parameter.Show less
CVE-2021-3350 1Delete Account Project 1Delete Account Jun 17, 2026 Feb 1, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 deleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason parameter.
CVE-2020-24670 1Hitachi 1Vantara Pentaho Jun 17, 2026 Jan 29, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, th...Show more The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'type' attribute of 'dashboardXml' parameter. Remediated in >= 7.1.0.25, >= 8.2.0.6, and >= 8.3.0.0 GA.Show less
CVE-2020-24669 1Hitachi 1Vantara Pentaho Jun 17, 2026 Jan 29, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The New Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a DOM-based Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically,...Show more The New Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a DOM-based Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'Analysis Report Description' field in 'About this Report' section. Remediated in >= 8.3.0.9, >= 9.0.0.1, and >= 9.1.0.0 GA.Show less
CVE-2020-24666 1Hitachi 1Vantara Pentaho Jun 17, 2026 Jan 29, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a stored Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vu...Show more The Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a stored Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'Display Name' parameter. Remediated in >= 9.1.0.1Show less
CVE-2020-24664 1Hitachi 1Vantara Pentaho Jun 17, 2026 Jan 29, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, th...Show more The dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'pho:title' attribute of 'dashboardXml' parameter. Remediated in >= 7.1.0.25, >= 8.2.0.6, and >= 8.3.0.0 GA.Show less
CVE-2020-29535 1Rsa 1Archer Jun 17, 2026 Jan 29, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Archer before 6.8 P4 (6.8.0.4) contains a stored XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted applic...Show more Archer before 6.8 P4 (6.8.0.4) contains a stored XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When application users access the corrupted data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application.Show less
CVE-2021-3298 1O Dyn 1Collabtive Jun 17, 2026 Jan 29, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit page, aka the manageuser.php?action=edit address1 parameter.
CVE-2021-26304 1Phpgurukul 1Daily Expense Tracker System Jun 17, 2026 Jan 29, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the add-expense.php Item parameter.
CVE-2021-26303 1Phpgurukul 1Daily Expense Tracker System Jun 17, 2026 Jan 29, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the user-profile.php Full Name field.
CVE-2020-36115 1Egavilanmedia 1Phpcrud Jun 17, 2026 Jan 28, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Stored Cross Site Scripting (XSS) vulnerability in EGavilan Media CRUD Operation with PHP, MySQL, Bootstrap, and Dompdf via First Name or Last Name parameter in the 'Add New Record Feature'.
CVE-2021-25647 1Testes Codigo 1Testes De Codigo Jun 17, 2026 Jan 28, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to be stored in the remote database and leading to its execution on client devices...Show more Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to be stored in the remote database and leading to its execution on client devices when loading the "feedback list", either by accessing the website directly or using the mobile application.Show less
CVE-2021-20186 1Moodle 1Moodle Jun 17, 2026 Jan 28, 2021 N/A· v4 5.4 MEDIUM· v3 2.1 LOW· v2 It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of TeX content was required to prevent the risk of stored XSS.
CVE-2021-20183 1Moodle 1Moodle Jun 17, 2026 Jan 28, 2021 N/A· v4 5.4 MEDIUM· v3 4.3 MEDIUM· v2 It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of search queries.

Previous 1...167116721673...2424 Next