CWE-79
48,485 CVEs • Abstraction: Base • Likelihood of Exploit: High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVEs (48,485)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Rails Admin Project 1Rails Admin Jun 17, 2026 Jan 12, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms. |
1Carbonite 1Server Backup Portal Jun 17, 2026 Jan 12, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 OpenText Carbonite Server Backup Portal before 8.8.7 allows XSS by an authenticated user via policy creation. |
1Sap 1Businessobjects Business Intelligence Jun 17, 2026 Jan 12, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript payload into the custom value input field of an Input Control, which can be executed...Show more |
IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...Show more |
REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The information submitted by the user is immediately returned in the response and not escaped leading to the reflected XSS vulnerab...Show more |
1Open Xchange 1Open Xchange Appsuite Jun 17, 2026 Jan 12, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI). |
2Debian Redcarpet Project2Debian Linux RedcarpetJun 17, 2026 Jan 11, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being...Show more |
1Jsoneditoronline 1Jsoneditor Jun 17, 2026 Jan 11, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript. |
XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg={XSS] to Home/c/ErrorController.php. |
XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr={XSS] to Home/c/WechatController.php. |
1Quest 1Policy Authority For Unified Communications Jun 17, 2026 Jan 11, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the BrowseDirs.do file via the title parameter. NOTE: This vulnerability...Show more |
1Quest 1Policy Authority For Unified Communications Jun 17, 2026 Jan 11, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Reports/index.jsp file via the by parameter. NOT...Show more |
1Quest 1Policy Authority For Unified Communications Jun 17, 2026 Jan 11, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/index.jsp file via the msg parameter. NOTE: This vulnerabilit...Show more |
1Quest 1Policy Authority For Unified Communications Jun 17, 2026 Jan 11, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the Error.jsp file via the err parameter (or indirectly via the cpr, tcp...Show more |
1Quest 1Policy Authority For Unified Communications Jun 17, 2026 Jan 11, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the ReportPreview.do file via the referer parameter. NOTE: This vulnerab...Show more |
1Quest 1Policy Authority For Unified Communications Jun 17, 2026 Jan 11, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the BrowseAssets.do file via the title parameter. NOTE: This vulnerabili...Show more |
1Quest 1Policy Authority For Unified Communications Jun 17, 2026 Jan 11, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Stored XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to store malicious code in multiple fields (first name, last name, and logon name) when creating or modifying a user via the submitUser.jsp file. NOT...Show more |
1Quest 1Policy Authority For Unified Communications Jun 17, 2026 Jan 11, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Search/index.jsp file via the added parameter. N...Show more |
1Quest 1Policy Authority For Unified Communications Jun 17, 2026 Jan 11, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the cConn.jsp file via the ur parameter. NOTE...Show more |
1Quest 1Policy Authority For Unified Communications Jun 17, 2026 Jan 11, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Reflected XSS in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the PolicyAuthority/Common/FolderControl.jsp file via the unqID paramet...Show more |