Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,472)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-22875 1Revive Adserver 1Revive Adserver Jun 17, 2026 Jan 28, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter.
CVE-2021-22874 1Revive Adserver 1Revive Adserver Jun 17, 2026 Jan 28, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the `period_preset` parameter.
CVE-2021-20622 1Aterm 2Wg2600hp2 Firmware Wg2600hp Firmware Jun 17, 2026 Jan 28, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
CVE-2021-20620 1Aterm 1Wg2600hp Firmware Jun 17, 2026 Jan 28, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in Aterm WF800HP firmware Ver1.0.9 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
CVE-2020-35124 1Acquia 1Mautic Jun 17, 2026 Jan 28, 2021 N/A· v4 9.6 CRITICAL· v3 6.8 MEDIUM· v2 A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript through the Referer header of asset downloads.
CVE-2021-3318 1Dzzoffice 1Dzzoffice Jun 17, 2026 Jan 27, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter.
CVE-2021-20357 1Ibm 11Collaborative Lifecycle Management Engineering InsightsEngineering Lifecycle Management+8 more Jun 17, 2026 Jan 27, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credent...Show more IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194963.Show less
CVE-2020-4865 1Ibm 11Collaborative Lifecycle Management Engineering InsightsEngineering Lifecycle Management+8 more Jun 17, 2026 Jan 27, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credent...Show more IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190741.Show less
CVE-2020-4855 1Ibm 11Collaborative Lifecycle Management Engineering InsightsEngineering Lifecycle Management+8 more Jun 17, 2026 Jan 27, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credent...Show more IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190457.Show less
CVE-2020-4524 1Ibm 11Collaborative Lifecycle Management Engineering InsightsEngineering Lifecycle Management+8 more Jun 17, 2026 Jan 27, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credent...Show more IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182434.Show less
CVE-2020-4820 1Ibm 1Cloud Pak For Security Jun 17, 2026 Jan 27, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Cloud Pak for Security (CP4S) 1.4.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadi...Show more IBM Cloud Pak for Security (CP4S) 1.4.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.Show less
CVE-2020-36012 1Bdtask 1Multi Store Jul 9, 2026 Jan 27, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Stored XSS vulnerability in BDTASK Multi-Store Inventory Management System 1.0 allows a local admin to inject arbitrary code via the Customer Name Field.
CVE-2020-23774 1Winmail Project 1Winmail Jun 17, 2026 Jan 26, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected XSS vulnerability exists in tohtml/convert.php of Winmail 6.5, which can cause JavaScript code to be executed.
CVE-2021-21283 1Flarum 1Sticky Jun 17, 2026 Jan 26, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extens...Show more Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to be injected as HTML on the discussion list. The issue was discovered following an internal audit. Any HTML would be injected through the m.trust() helper. This resulted in an HTML injection where <script> tags would not be executed. However it was possible to run javascript from other HTML attributes, enabling a cross-site scripting (XSS) attack to be performed. Since the exploit only happens with the first post of a pinned discussion, an attacker would need the ability to pin their own discussion, or be able to edit a discussion that was previously pinned. On forums where all pinned posts are authored by your staff, you can be relatively certain the vulnerability has not been exploited. Forums where some user-created discussions were pinned can look at the first post edit date to find whether the vulnerability might have been exploited. Because Flarum doesn't store the post content history, you cannot be certain if a malicious edit was reverted. The fix will be available in version v0.1.0-beta.16 with Flarum beta 16. The fix has already been back-ported to Flarum beta 15 as version v0.1.0-beta.15.1 of the Sticky extension. Forum administrators can disable the Sticky extension until they are able to apply the update. The vulnerability cannot be exploited while the extension is disabled.Show less
CVE-2021-23272 1Tibco 2Bpm Enterprise Bpm Enterprise Distribution For Silver Fabric Jun 17, 2026 Jan 26, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The Application Development Clients component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows a low privilege...Show more The Application Development Clients component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Cross Site Scripting (XSS) attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO BPM Enterprise: versions 4.3.0 and below and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric: versions 4.3.0 and below.Show less
CVE-2021-3186 1Tenda 1Ac5 Firmware Jun 17, 2026 Jan 26, 2021 N/A· v4 5.4 MEDIUM· v3 4.3 MEDIUM· v2 A Stored Cross-site scripting (XSS) vulnerability in /main.html Wifi Settings in Tenda AC5 AC1200 version V15.03.06.47_multi allows remote attackers to inject arbitrary web script or HTML via the Wifi Name parameter.
CVE-2021-22872 1Revive Adserver 1Revive Adserver Jun 17, 2026 Jan 26, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivery script. While this issue was previously addressed in modern browsers as CVE-...Show more Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivery script. While this issue was previously addressed in modern browsers as CVE-2020-8115, some older browsers (e.g., IE10) that do not automatically URL encode parameters were still vulnerable.Show less
CVE-2021-22871 1Revive Adserver 1Revive Adserver Jun 17, 2026 Jan 26, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen...Show more Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting (XSS) vulnerability.Show less
CVE-2020-8292 1Rocketchat 1Rocket.chat Jun 17, 2026 Jan 26, 2021 N/A· v4 5.4 MEDIUM· v3 4.3 MEDIUM· v2 Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting (XSS) vulnerability via the drag & drop functionality in message boxes.
CVE-2020-8288 1Rocketchat 1Rocket.chat Jun 17, 2026 Jan 26, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the `value` parameter.

Previous 1...167216731674...2424 Next