Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,487)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-4910 1Ibm 1Cloud Pak System Jun 17, 2026 Jan 4, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...Show more IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191274.Show less
CVE-2020-4909 1Ibm 1Cloud Pak System Jun 17, 2026 Jan 4, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...Show more IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191273.Show less
CVE-2019-16960 1Solarwinds 1Web Help Desk Jun 17, 2026 Jan 4, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field.
CVE-2019-16956 1Solarwinds 1Web Help Desk Jun 17, 2026 Jan 4, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket.
CVE-2021-3002 1Seopanel 1Seo Panel Jun 17, 2026 Jan 1, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter.
CVE-2020-35717 1Electronjs 1Zonote Jun 17, 2026 Jan 1, 2021 N/A· v4 9.0 CRITICAL· v3 3.5 LOW· v2 zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution (because nodeIntegration in webPreferences is true).
CVE-2020-35947 1Pagelayer 1Pagelayer Jun 17, 2026 Jan 1, 2021 N/A· v4 7.4 HIGH· v3 6.5 MEDIUM· v2 An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. Nearly all of the AJAX action endpoints lacked permission checks, allowing these actions to be executed by anyone authenticated on the site. Thi...Show more An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. Nearly all of the AJAX action endpoints lacked permission checks, allowing these actions to be executed by anyone authenticated on the site. This happened because nonces were used as a means of authorization, but a nonce was present in a publicly viewable page. The greatest impact was the pagelayer_save_content function that allowed pages to be modified and allowed XSS to occur.Show less
CVE-2020-35946 1Semperplugins 1All In One Seo Pack Jun 17, 2026 Jan 1, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in the All in One SEO Pack plugin before 3.6.2 for WordPress. The SEO Description and Title fields are vulnerable to unsanitized input from a Contributor, leading to stored XSS.
CVE-2020-35944 1Pagelayer 1Pagelayer Jun 17, 2026 Jan 1, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. The pagelayer_settings_page function is vulnerable to CSRF, which can lead to XSS.
CVE-2020-35937 1Pickplugins 2Post Grid Team Showcase Jun 17, 2026 Jan 1, 2021 N/A· v4 8.0 HIGH· v3 6.0 MEDIUM· v2 Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafte...Show more Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts.Show less
CVE-2020-35936 1Pickplugins 2Post Grid Team Showcase Jun 17, 2026 Jan 1, 2021 N/A· v4 8.0 HIGH· v3 6.0 MEDIUM· v2 Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted pay...Show more Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.Show less
CVE-2020-35933 1Thenewsletterplugin 1Newsletter Jun 17, 2026 Jan 1, 2021 N/A· v4 6.5 MEDIUM· v3 3.5 LOW· v2 A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpc_render AJAX request containing eithe...Show more A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpc_render AJAX request containing either JavaScript in an options parameter, or a base64-encoded JSON string containing JavaScript in the encoded_options parameter.Show less
CVE-2020-35930 1Seopanel 1Seo Panel Jun 17, 2026 Dec 31, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Seo Panel 4.8.0 allows stored XSS by an Authenticated User via the url parameter, as demonstrated by the seo/seopanel/websites.php URI.
CVE-2019-25011 1Netbox 1Netbox Jun 17, 2026 Dec 31, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a GFM-rendered field, as demonstrated by /dcim/sites/add/ comments.
CVE-2020-25799 1Limesurvey 1Limesurvey Jun 17, 2026 Dec 31, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administrative user, the JavaScript code will be executed in the brows...Show more LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser.Show less
CVE-2020-25797 1Limesurvey 1Limesurvey Jun 17, 2026 Dec 31, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters). When the survey participant being edited, e.g. by an administrative user, the JavaScript code...Show more LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters). When the survey participant being edited, e.g. by an administrative user, the JavaScript code will be executed in the browser.Show less
CVE-2020-35741 1Hgiga 4Msr45 Isherlock Antispam Msr45 Isherlock UserSsr45 Isherlock Antispam+1 more Jun 17, 2026 Dec 31, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntax for XSS attacks.
CVE-2020-35740 1Hgiga 4Msr45 Isherlock Antispam Msr45 Isherlock UserSsr45 Isherlock Antispam+1 more Jun 17, 2026 Dec 31, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks.
CVE-2020-26296 1Vega Project 1Vega Jun 17, 2026 Dec 30, 2020 N/A· v4 8.7 HIGH· v3 3.5 LOW· v2 Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package. In Vega before version 5.17.3 there is an XSS vulnerability in Vega expre...Show more Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package. In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Vega expression, an attacker could execute arbitrary javascript on a victim's machine. This is fixed in version 5.17.3Show less
CVE-2020-29231 1Egavilanmedia 1User Registration And Login System With Admin Panel Jul 9, 2026 Dec 30, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Profile Page. This vulnerability can result in the attacker injecting the XSS payload in Admin...Show more EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Profile Page. This vulnerability can result in the attacker injecting the XSS payload in Admin Full Name and each time admin visits the Profile page from the admin panel, the XSS triggers.Show less

Previous 1...168116821683...2425 Next