← Back
CWE-79

48,499 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,499)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-25798
1Limesurvey
1Limesurvey
Jun 17, 2026
Nov 17, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A stored cross-site scripting (XSS) vulnerability in LimeSurvey before and including 3.21.1 allows authenticated users with correct permissions to inject arbitrary web script or HTML via parameter ParticipantAttributeNam...Show more
A stored cross-site scripting (XSS) vulnerability in LimeSurvey before and including 3.21.1 allows authenticated users with correct permissions to inject arbitrary web script or HTML via parameter ParticipantAttributeNamesDropdown of the Attributes on the central participant database page. When the survey attribute being edited or viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser.Show less
CVE-2020-28647
1Progress
1Moveit Transfer
Jun 17, 2026
Nov 17, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. If a victim within the MOVEit Transfer instance interacts with the stored payload, it could invoke and e...Show more
In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. If a victim within the MOVEit Transfer instance interacts with the stored payload, it could invoke and execute arbitrary code within the context of the victim's browser (XSS).Show less
CVE-2020-25833
1Microfocus
1Idol
Jun 17, 2026
Nov 17, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Persistent cross-Site Scripting vulnerability on Micro Focus IDOL product, affecting all version prior to version 12.7. The vulnerability could be exploited to perform Persistent XSS attack.
CVE-2020-25832
1Microfocus
1Filr
Jun 17, 2026
Nov 17, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Reflected Cross Site scripting vulnerability on Micro Focus Filr product, affecting version 4.2.1. The vulnerability could be exploited to perform Reflected XSS attack.
CVE-2020-10776
1Redhat
1Keycloak
Jun 17, 2026
Nov 17, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to perform a Cross-site scripting attack.
CVE-2020-25834
1Microfocus
1Arcsight Logger
Jun 17, 2026
Nov 17, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting version 7.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS).
CVE-2020-11860
1Microfocus
1Arcsight Logger
Jun 17, 2026
Nov 17, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS)
CVE-2020-26225
1Prestashop
1Product Comments
Jun 17, 2026
Nov 16, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a malicious link. The problem was introduced in version 4.0.0 and is fixed in 4.2....Show more
In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a malicious link. The problem was introduced in version 4.0.0 and is fixed in 4.2.0Show less
CVE-2020-4705
1Ibm
1Sterling B2b Integrator
Jun 17, 2026
Nov 16, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu...Show more
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187190.Show less
CVE-2020-4672
1Ibm
1Business Automation Workflow
Jun 17, 2026
Nov 16, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadi...Show more
IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186285.Show less
CVE-2020-27991
1Nagios
1Nagios Xi
Jun 17, 2026
Nov 16, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field).
CVE-2020-27990
1Nagios
1Nagios Xi
Jun 17, 2026
Nov 16, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent).
CVE-2020-27989
1Nagios
1Nagios Xi
Jun 17, 2026
Nov 16, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard).
CVE-2020-27988
1Nagios
1Nagios Xi
Jun 17, 2026
Nov 16, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field).
CVE-2020-13773
1Ivanti
1Endpoint Manager
Jun 17, 2026
Nov 16, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Ivanti Endpoint Manager through 2020.1.1 allows XSS via /LDMS/frm_splitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frm_splitcollapse.aspx, /LDMS/alert_log.aspx, /LDMS/ServerList.aspx, /LDMS/frm_coremainfrm.aspx, /LDMS/frm_f...Show more
Ivanti Endpoint Manager through 2020.1.1 allows XSS via /LDMS/frm_splitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frm_splitcollapse.aspx, /LDMS/alert_log.aspx, /LDMS/ServerList.aspx, /LDMS/frm_coremainfrm.aspx, /LDMS/frm_findfrm.aspx, /LDMS/frm_taskfrm.aspx, and /LDMS/query_browsecomp.aspx.Show less
CVE-2020-27459
1Chronoengine
1Chronoforums
Jun 17, 2026
Nov 16, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Chronoforeum 2.0.11 allows Stored XSS vulnerabilities when inserting a crafted payload into a post. If any user sees the post, the inserted XSS code is executed.
CVE-2020-7773
1Markdown It Highlightjs Project
1Markdown It Highlightjs
Jun 17, 2026
Nov 16, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs =...Show more
This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require("markdown-it-highlightjs"); const md = require('markdown-it'); const reuslt_xss = md() .use(markdownItHighlightjs, { inline: true }) .render('console.log(42){.">js}'); console.log(reuslt_xss);Show less
CVE-2020-5663
1Riken
1Xoonips
Jun 17, 2026
Nov 16, 2020
N/A· v4
5.4 MEDIUM· v3
4.0 MEDIUM· v2
Stored cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject arbitrary script via unspecified vectors.
CVE-2020-5662
1Riken
1Xoonips
Jun 17, 2026
Nov 16, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Reflected cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject arbitrary script via unspecified vectors.
CVE-2020-28650
1Wpbakery
1Page Builder
Jun 17, 2026
Nov 16, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard WordPress XSS protection mechanism for the Author and Contributor roles.