Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,492)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-29250 1Cxuu 1Cxuucms Jun 17, 2026 Dec 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php.
CVE-2020-29249 1Cxuu 1Cxuucms Jun 17, 2026 Dec 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 CXUUCMS V3 allows class="layui-input" XSS.
CVE-2020-29204 1Xuxueli 1Xxl Job Jun 17, 2026 Dec 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java.
CVE-2020-35437 1Intelliants 1Subrion Cms Jun 17, 2026 Dec 26, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Subrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatar[path] parameter in a POST request to the /_core/profile/ URI.
CVE-2020-35349 1Techkshetrainfo 1Savsoft Quiz Jun 17, 2026 Dec 26, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Savsoft Quiz 5 is affected by: Cross Site Scripting (XSS) via field_title (aka a title on the custom fields page).
CVE-2020-35346 1Cxuu 1Cxuucms Jun 17, 2026 Dec 26, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add.
CVE-2020-29172 1Litespeedtech 1Litespeed Cache Jun 17, 2026 Dec 26, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting.
CVE-2020-27515 1Techkshetrainfo 1Savsoft Quiz Jun 17, 2026 Dec 26, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Cross Site Scripting (XSS) vulnerability in Savsoft Quiz v5.0 allows remote attackers to inject arbitrary web script or HTML via the Skype ID field.
CVE-2020-35707 1Daybydaycrm 1Daybyday Jun 17, 2026 Dec 25, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.
CVE-2020-35706 1Daybydaycrm 1Daybyday Jun 17, 2026 Dec 25, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.
CVE-2020-35705 1Daybydaycrm 1Daybyday Jun 17, 2026 Dec 25, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.
CVE-2020-35704 1Daybydaycrm 1Daybyday Jun 17, 2026 Dec 25, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.
CVE-2020-29247 1Wondercms 1Wondercms Jul 9, 2026 Dec 24, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Admin Panel. An attacker can inject the XSS payload in Page keywords and each time any user will visit the website, the XSS triggers, and the attacker can...Show more WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Admin Panel. An attacker can inject the XSS payload in Page keywords and each time any user will visit the website, the XSS triggers, and the attacker can able to steal the cookie according to the crafted payload.Show less
CVE-2020-35659 1Pi Hole 1Pi Hole Jun 17, 2026 Dec 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. An attacker with the ability to directly or indirectly query DNS with a malicious hostname can cause arbitrary JavaScript to execute when the Pi-hole...Show more The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. An attacker with the ability to directly or indirectly query DNS with a malicious hostname can cause arbitrary JavaScript to execute when the Pi-hole administrator visits the Query Log or Long-term data Query Log page.Show less
CVE-2020-27726 1F5 1Big Ip Access Policy Manager Jun 17, 2026 Dec 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.2, a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when...Show more In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.2, a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system.Show less
CVE-2020-27719 1F5 14Big Ip Access Policy Manager Big Ip Advanced Firewall ManagerBig Ip Advanced Web Application Firewall+11 more Jun 17, 2026 Dec 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 On BIG-IP 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.
CVE-2020-28184 1Terra Master 1Tos Jun 17, 2026 Dec 24, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php.
CVE-2020-35677 1Bigprof 1Online Invoicing System Jun 17, 2026 Dec 24, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEditGroup.php to create a new group, resulting in Stored XSS. The caveat here is th...Show more BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEditGroup.php to create a new group, resulting in Stored XSS. The caveat here is that an attacker would need administrative privileges in order to create the payload. One might think this completely mitigates the privilege-escalation impact as there is only one high-privileged role. However, it was discovered that the endpoint responsible for creating the group lacks CSRF protection.Show less
CVE-2020-35676 1Bigprof 1Online Invoicing System Jun 17, 2026 Dec 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 BigProf Online Invoicing System before 3.1 fails to correctly sanitize an XSS payload when a user registers using the self-registration functionality. As such, an attacker can input a crafted payload that will execute up...Show more BigProf Online Invoicing System before 3.1 fails to correctly sanitize an XSS payload when a user registers using the self-registration functionality. As such, an attacker can input a crafted payload that will execute upon the application's administrator browsing the registered users' list. Once the arbitrary Javascript is executed in the context of the admin, this will cause the attacker to gain administrative privileges, effectively leading into an application takeover. This affects app/membership_signup.php and app/admin/pageViewMembers.php.Show less
CVE-2020-2503 1Qnap 1Qes Jun 17, 2026 Dec 24, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.

Previous 1...168516861687...2425 Next