Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,492)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-4657 1Ibm 1Sterling B2b Integrator Jun 17, 2026 Dec 16, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Sterling B2B Integrator 5.2.0.0 through 6.0.3.2 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended func...Show more IBM Sterling B2B Integrator 5.2.0.0 through 6.0.3.2 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186094.Show less
CVE-2020-28930 1Epson 1Eps Tse Server 8 Firmware Jun 17, 2026 Dec 16, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A Cross-Site Scripting (XSS) issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 (21.0.11) allows an authenticated attacker to inject a JavaScript payload in the u...Show more A Cross-Site Scripting (XSS) issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 (21.0.11) allows an authenticated attacker to inject a JavaScript payload in the user management page that is executed by an administrator.Show less
CVE-2019-14478 1Adremsoft 1Netcrunch Jun 17, 2026 Dec 16, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 AdRem NetCrunch 10.6.0.4587 has a stored Cross-Site Scripting (XSS) vulnerability in the NetCrunch web client. The user's input data is not properly encoded when being echoed back to the user. This data can be interprete...Show more AdRem NetCrunch 10.6.0.4587 has a stored Cross-Site Scripting (XSS) vulnerability in the NetCrunch web client. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript code in the context of the user's browser if the victim opens or searches for a node whose "Display Name" contains an XSS payload.Show less
CVE-2020-26198 1Dell 1Idrac9 Firmware Jun 17, 2026 Dec 16, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Dell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web application. A remote attacker could potentially exploit this vulnerability to run mali...Show more Dell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web application. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.Show less
CVE-2018-16243 1Solarwinds 1Database Performance Analyzer Nov 21, 2024 Dec 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc, centralManage.cen, userAdministration.iwc, database.iwc, alertManagement.iwc, e...Show more SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc, centralManage.cen, userAdministration.iwc, database.iwc, alertManagement.iwc, eventAnnotations.iwc, and central.cen.Show less
CVE-2020-35416 1Onlineonly 1Phpjabbers Appointment Scheduler Jun 17, 2026 Dec 15, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admin login webpage (with different request parameters), allows remote attackers to inject arbitrary web...Show more Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admin login webpage (with different request parameters), allows remote attackers to inject arbitrary web script or HTML.Show less
CVE-2020-23957 1Pega 1Pega Platform Jun 17, 2026 Dec 15, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession request to a PRAuth URI.
CVE-2020-35396 1Egavilanmedia 1Barcodes Generator Jun 17, 2026 Dec 15, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 EGavilan Barcodes generator 1.0 is affected by: Cross Site Scripting (XSS) via the index.php. An Attacker is able to inject the XSS payload in the web application each time a user visits the website.
CVE-2020-35395 1Egavilanmedia 1Expense Management System Jun 17, 2026 Dec 15, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS in the Add Expense Component of EGavilan Media Expense Management System 1.0 allows an attacker to permanently store malicious JavaScript code via the 'description' field
CVE-2020-28457 1S Cart 1S Cart Jun 17, 2026 Dec 15, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 This affects the package s-cart/core before 4.4. The search functionality of the admin dashboard in core/src/Admin/Controllers/AdminOrderController.phpindex is vulnerable to XSS.
CVE-2020-28456 1S Cart 1S Cart Jun 17, 2026 Dec 15, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The package s-cart/core before 4.4 are vulnerable to Cross-site Scripting (XSS) via the admin panel.
CVE-2019-19288 1Siemens 1Xhq Jun 17, 2026 Dec 14, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link.
CVE-2019-19285 1Siemens 1Xhq Jun 17, 2026 Dec 14, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow injections that could lead to XSS attacks if unsuspecting users are tricked into accessing a malicious link.
CVE-2019-19284 1Siemens 1Xhq Jun 17, 2026 Dec 14, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow Cross-Site Scripting (XSS) attacks if an attacker is able to modify content of particular web pages, causing the application...Show more A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow Cross-Site Scripting (XSS) attacks if an attacker is able to modify content of particular web pages, causing the application to behave in unexpected ways for legitimate users.Show less
CVE-2020-29304 1Directoriespro 1Directories Pro Jun 17, 2026 Dec 14, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability exists in the SabaiApps WordPress Directories Pro plugin version 1.3.45 and previous, allows attackers who have convinced a site administrator to import a specially crafted CSV...Show more A cross-site scripting (XSS) vulnerability exists in the SabaiApps WordPress Directories Pro plugin version 1.3.45 and previous, allows attackers who have convinced a site administrator to import a specially crafted CSV file to inject arbitrary web script or HTML as the victim is proceeding through the file import workflow.Show less
CVE-2020-29303 1Directoriespro 1Directories Pro Jun 17, 2026 Dec 14, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arbitrary web script or HTML via a POST to /wp-admin/admin.php?page=drts/directorie...Show more A cross-site scripting (XSS) vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arbitrary web script or HTML via a POST to /wp-admin/admin.php?page=drts/directories&q=%2F with _drts_form_build_id parameter containing the XSS payload and _t_ parameter set to an invalid or non-existent CSRF token.Show less
CVE-2020-28859 1Openasset 1Digital Asset Management Jul 9, 2026 Dec 14, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting attacks.
CVE-2020-28857 1Openasset 1Digital Asset Management Jul 9, 2026 Dec 14, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 OpenAsset Digital Asset Management (DAM) through 12.0.19, does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for stored cross-site scripting attacks.
CVE-2020-35202 1Igniterealtime 1Openfire Jun 17, 2026 Dec 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS.
CVE-2020-35201 1Igniterealtime 1Openfire Jun 17, 2026 Dec 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS.

Previous 1...168816891690...2425 Next