Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,492)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-35200 1Igniterealtime 1Openfire Jun 17, 2026 Dec 12, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS.
CVE-2020-35199 1Igniterealtime 1Openfire Jun 17, 2026 Dec 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS.
CVE-2020-29455 1Smartystreets 1Liveaddressplugin.js Jun 17, 2026 Dec 11, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows remote attackers to inject arbitrary web script or HTML via any address paramete...Show more A cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows remote attackers to inject arbitrary web script or HTML via any address parameter (e.g., street or country).Show less
CVE-2020-5950 1F5 1Big Ip Advanced Firewall Manager Jun 17, 2026 Dec 11, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 On BIG-IP 14.1.0-14.1.2.6, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role.
CVE-2020-5948 1F5 11Big Ip Access Policy Manager Big Ip Advanced Firewall ManagerBig Ip Analytics+8 more Jun 17, 2026 Dec 11, 2020 N/A· v4 9.6 CRITICAL· v3 6.8 MEDIUM· v2 On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a...Show more On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role.Show less
CVE-2020-17515 1Apache 1Airflow Jun 17, 2026 Dec 11, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in...Show more The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.Show less
CVE-2020-35132 2Fedoraproject Phpldapadmin Project 2Fedora Phpldapadmin Jun 17, 2026 Dec 11, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values that may be executed by other users at a later time via get_request in lib/function.php.
CVE-2020-35127 1Igniterealtime 1Openfire Jun 17, 2026 Dec 11, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS.
CVE-2020-35126 1Typesettercms 1Typesetter Jun 17, 2026 Dec 11, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Typesetter CMS 5.x through 5.1 allows admins to conduct Site Title persistent XSS attacks via an Admin/Configuration URI. NOTE: the significance of this report is disputed because "admins are considered trustworthy.
CVE-2020-16608 1Notable 1Notable Jun 17, 2026 Dec 10, 2020 N/A· v4 9.6 CRITICAL· v3 9.3 HIGH· v2 Notable 1.8.4 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true).
CVE-2020-26407 1Gitlab 1Gitlab Jun 17, 2026 Dec 10, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scripting to other users via importing a malicious project
CVE-2020-24445 1Adobe 2Experience Manager Experience Manager Cloud Service Jun 17, 2026 Dec 10, 2020 N/A· v4 9.0 CRITICAL· v3 3.5 LOW· v2 AEM's Cloud Service offering, as well as version 6.5.6.0 (and below), are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form...Show more AEM's Cloud Service offering, as well as version 6.5.6.0 (and below), are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.Show less
CVE-2020-2498 1Qnap 2Qts Quts Hero Jun 17, 2026 Dec 10, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration. QANP have already fixed these vulnerabilities in the following versions of QTS and...Show more If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and laterShow less
CVE-2020-2497 1Qnap 2Qts Quts Hero Jun 17, 2026 Dec 10, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs. QANP have already fixed these vulnerabilities in the following versions of QTS and Qu...Show more If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and laterShow less
CVE-2020-2496 1Qnap 2Qts Quts Hero Jun 17, 2026 Dec 10, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. Q...Show more If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and laterShow less
CVE-2020-2495 1Qnap 2Qts Quts Hero Jun 17, 2026 Dec 10, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. Q...Show more If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and laterShow less
CVE-2020-2494 1Qnap 1Music Station Jun 17, 2026 Dec 10, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 This cross-site scripting vulnerability in Music Station allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in the following versions of Music Station. QuTS hero h4.5.1: Music St...Show more This cross-site scripting vulnerability in Music Station allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in the following versions of Music Station. QuTS hero h4.5.1: Music Station 5.3.13 and later QTS 4.5.1: Music Station 5.3.12 and later QTS 4.4.3: Music Station 5.3.12 and laterShow less
CVE-2020-2493 1Qnap 1Multimedia Console Jun 17, 2026 Dec 10, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in Multimedia Console 1.1.5 and later.
CVE-2020-2491 1Qnap 1Photo Station Jun 17, 2026 Dec 10, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. QTS 4.5.1: Photo Statio...Show more This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. QTS 4.5.1: Photo Station 6.0.12 and later QTS 4.4.3: Photo Station 6.0.12 and later QTS 4.3.6: Photo Station 5.7.12 and later QTS 4.3.4: Photo Station 5.7.13 and later QTS 4.3.3: Photo Station 5.4.10 and later QTS 4.2.6: Photo Station 5.2.11 and laterShow less
CVE-2020-17147 1Microsoft 1Dynamics 365 Jun 17, 2026 Dec 10, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Dynamics CRM Webclient Cross-site Scripting Vulnerability

Previous 1...168916901691...2425 Next