Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,485)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-35203 1Quest 1Policy Authority For Unified Communications Jun 17, 2026 Jan 11, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the initFile.jsp file via the msg parameter....Show more Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the initFile.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainerShow less
CVE-2020-4733 1Ibm 13Collaborative Lifecycle Management Doors NextEngineering Insights+10 more Jun 17, 2026 Jan 8, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to creden...Show more IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188127.Show less
CVE-2020-4697 1Ibm 13Collaborative Lifecycle Management Doors NextEngineering Insights+10 more Jun 17, 2026 Jan 8, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to creden...Show more IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186790.Show less
CVE-2020-4691 1Ibm 13Collaborative Lifecycle Management Doors NextEngineering Insights+10 more Jun 17, 2026 Jan 8, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to creden...Show more IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186698.Show less
CVE-2020-16030 1Google 1Chrome Jun 17, 2026 Jan 8, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
CVE-2020-27262 1Innokasmedical 1Vital Signs Monitor Vc150 Firmware Jun 17, 2026 Jan 8, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 A stored cross-site scripting (XSS) vulnerability exists in the affected products that allow an attacker to inject arbitrary web script or HTML via the...Show more Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 A stored cross-site scripting (XSS) vulnerability exists in the affected products that allow an attacker to inject arbitrary web script or HTML via the filename parameter to multiple update endpoints of the administrative web interface.Show less
CVE-2021-3111 1Concretecms 1Concrete Cms Jun 17, 2026 Jan 8, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI.
CVE-2020-4666 1Ibm 1Engineering Requirements Quality Assistant On Premises Jun 17, 2026 Jan 8, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...Show more IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186281.Show less
CVE-2020-4664 1Ibm 1Engineering Requirements Quality Assistant On Premises Jun 17, 2026 Jan 8, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...Show more IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186235.Show less
CVE-2020-4663 1Ibm 1Engineering Requirements Quality Assistant On Premises Jun 17, 2026 Jan 8, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...Show more IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186234.Show less
CVE-2020-4895 1Ibm 1Emptoris Strategic Supply Management Jun 17, 2026 Jan 7, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intende...Show more IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190986.Show less
CVE-2020-4892 1Ibm 1Emptoris Contract Management Jun 17, 2026 Jan 7, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...Show more IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190979.Show less
CVE-2020-25476 1Liferay 1Liferay Portal Jun 17, 2026 Jan 7, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar. An attacker can insert the malicious payload on the username, lastname o...Show more Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar. An attacker can insert the malicious payload on the username, lastname or surname fields of its own profile, and the malicious payload will be injected and reflected in the calendar of the user who submitted the payload. An attacker could escalate its privileges in case an admin visits the calendar that injected the payload.Show less
CVE-2020-26768 1Formstone 1Formstone Jun 17, 2026 Jan 7, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Formstone <=1.4.16 is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper validation of user supplied input in the upload-target.php and upload-chunked.php files. A remote attacker could...Show more Formstone <=1.4.16 is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper validation of user supplied input in the upload-target.php and upload-chunked.php files. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site once the URL is clicked or visited. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials, force malware execution, user redirection and others.Show less
CVE-2020-24903 1Cutesoft 1Cute Editor Jun 17, 2026 Jan 7, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to...Show more Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.Show less
CVE-2020-24902 1Quixplorer Project 1Quixplorer Jun 17, 2026 Jan 7, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Quixplorer <=2.4.1 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a...Show more Quixplorer <=2.4.1 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.Show less
CVE-2020-24901 1Krpano 1Krpano Jun 17, 2026 Jan 7, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The default installation of Krpano Panorama Viewer version <=1.20.8 is vulnerable to Reflected XSS due to insecure remote js load in file viewer/krpano.html, parameter plugin[test].url.
CVE-2020-24900 1Krpano 1Krpano Jun 17, 2026 Jan 7, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The default installation of Krpano Panorama Viewer version <=1.20.8 is prone to Reflected XSS due to insecure XML load in file /viewer/krpano.html, parameter xml.
CVE-2020-35262 1Digisol 1Dg Hr3400 Firmware Jul 9, 2026 Jan 6, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross Site Scripting (XSS) vulnerability in Digisol DG-HR3400 can be exploited via the NTP server name in Time and date module and "Keyword" in URL Filter.
CVE-2020-25498 1Beetel 1777vr1 Firmware Jul 9, 2026 Jan 6, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Cross Site Scripting (XSS) vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Time and "Keyword" in URL Filter.

Previous 1...167916801681...2425 Next