Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,494)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-28727 1Seeddms 1Seeddms Jul 9, 2026 Dec 7, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to views/bootstrap/class.DropFolderChooser.php.
CVE-2020-29572 2Misp Misp Project 2Misp Misp Jun 22, 2026 Dec 6, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field.
CVE-2020-25449 1Arachnys 1Cabot Jun 17, 2026 Dec 4, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Cross Site Scripting (XSS) vulnerability in Arachnys Cabot 0.11.12 can be exploited via the Address column.
CVE-2020-27409 1Os4ed 1Opensis Jun 17, 2026 Dec 4, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 OpenSIS Community Edition before 7.5 is affected by a cross-site scripting (XSS) vulnerability in SideForStudent.php via the modname parameter.
CVE-2020-27783 6Debian FedoraprojectLxml+3 more 8Communications Offline Mediation Controller Debian LinuxEnterprise Linux+5 more Jun 17, 2026 Dec 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could...Show more A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.Show less
CVE-2020-28938 1Openclinic Project 1Openclinic Jun 17, 2026 Dec 3, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 OpenClinic version 0.8.2 is affected by a stored XSS vulnerability in lib/Check.php that allows users of the application to force actions on behalf of other users.
CVE-2020-5678 1Weseek 1Growi Jun 17, 2026 Dec 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors.
CVE-2020-5677 1Weseek 1Growi Jun 17, 2026 Dec 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors.
CVE-2020-5638 1Desknets 1Neo Jun 17, 2026 Dec 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in desknet's NEO (desknet's NEO Small License V5.5 R1.5 and earlier, and desknet's NEO Enterprise License V5.5 R1.5 and earlier) allows remote attackers to inject arbitrary script via u...Show more Cross-site scripting vulnerability in desknet's NEO (desknet's NEO Small License V5.5 R1.5 and earlier, and desknet's NEO Enterprise License V5.5 R1.5 and earlier) allows remote attackers to inject arbitrary script via unspecified vectors.Show less
CVE-2020-29240 1Lepton Cms 1Leptoncms Jun 17, 2026 Dec 2, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS). An attacker can inject the XSS payload in the URL field of the admin page and each time an admin visits the Menu-Pages-Pages Overview section, the XSS will be t...Show more Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS). An attacker can inject the XSS payload in the URL field of the admin page and each time an admin visits the Menu-Pages-Pages Overview section, the XSS will be triggered.Show less
CVE-2020-29239 1Janobe 1Online Voting System Jun 17, 2026 Dec 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS). This vulnerability can result in an attacker injecting the XSS payload in the User Registration section. When an admin visits the V...Show more Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS). This vulnerability can result in an attacker injecting the XSS payload in the User Registration section. When an admin visits the View Detail of Application section from the admin panel, the attacker can able to steal the cookie according to the crafted payload.Show less
CVE-2020-29456 1Papermerge 1Papermerge Jun 17, 2026 Dec 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a...Show more Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in Papermerge, a malicious document can be sent by email and is automatically uploaded into the Papermerge web application. Therefore, no authentication is required to exploit XSS if email consumption is configured. Otherwise authentication is required.Show less
CVE-2019-16958 1Solarwinds 1Help Desk Jun 17, 2026 Dec 1, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site Scripting (XSS) vulnerability in SolarWinds Web Help Desk 12.7.0 allows attacker to inject arbitrary web script or HTML via Location Name.
CVE-2020-29315 1Thinkadmin 1Thinkadmin Jun 17, 2026 Dec 1, 2020 N/A· v4 5.4 MEDIUM· v3 4.3 MEDIUM· v2 ThinkAdmin version v1 v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script or HTML.
CVE-2020-7546 1Schneider Electric 5Ecostruxure Energy Expert Ecostruxure Power Monitoring ExpertPower Manager+2 more Jun 17, 2026 Dec 1, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that c...Show more A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow an attacker to perform actions on behalf of the authorized user when accessing an affected webpage.Show less
CVE-2020-29395 1Myeventon 1Eventon Jun 17, 2026 Nov 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field.
CVE-2020-29364 1Netartmedia 1News Lister Jun 17, 2026 Nov 30, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 In NetArt News Lister 1.0.0, the news headlines vulnerable to stored xss attacks. Attackers can inject codes in news titles.
CVE-2020-27659 1Synology 1Safeaccess Jun 17, 2026 Nov 30, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Multiple cross-site scripting (XSS) vulnerabilities in Synology SafeAccess before 1.2.3-0234 allow remote attackers to inject arbitrary web script or HTML via the (1) domain or (2) profile parameter.
CVE-2017-15686 1Craftercms 1Crafter Cms Nov 21, 2024 Nov 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.
CVE-2017-15682 1Craftercms 1Crafter Cms Jul 9, 2026 Nov 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel.

Previous 1...169116921693...2425 Next