Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,503)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-19956 1Qnap 1Photo Station Nov 21, 2024 Nov 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP System...Show more The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10.Show less
CVE-2018-19955 1Qnap 1Photo Station Nov 21, 2024 Nov 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP System...Show more The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10.Show less
CVE-2018-19954 1Qnap 1Photo Station Nov 21, 2024 Nov 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP System...Show more The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10.Show less
CVE-2018-19951 1Qnap 1Music Station Nov 21, 2024 Nov 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions...Show more If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.Show less
CVE-2020-15276 1Basercms 1Basercms Jun 17, 2026 Oct 30, 2020 N/A· v4 8.7 HIGH· v3 3.5 LOW· v2 baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in vers...Show more baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1.Show less
CVE-2020-15273 1Basercms 1Basercms Jun 17, 2026 Oct 30, 2020 N/A· v4 8.1 HIGH· v3 3.5 LOW· v2 baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaS...Show more baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can access the file upload function category list, subsite setting list, widget area edit, and feed list on the management screen. The issue was introduced in version 4.0.0. It is fixed in version 4.4.1.Show less
CVE-2020-27885 1Wso2 1Api Manager Jun 17, 2026 Oct 29, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged-in user’s session by stealing cookies which means that a malicious h...Show more Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged-in user’s session by stealing cookies which means that a malicious hacker can change the logged-in user’s password and invalidate the session of the victim while the hacker maintains access.Show less
CVE-2020-26205 1Sal Project 1Sal Jun 17, 2026 Oct 29, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Sal is a multi-tenanted reporting dashboard for Munki with the ability to display information from Facter. In Sal through version 4.1.6 there is an XSS vulnerability on the machine_list view.
CVE-2020-5932 1F5 1Big Ip Application Security Manager Jun 17, 2026 Oct 29, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 On BIG-IP ASM 15.1.0-15.1.0.5, a cross-site scripting (XSS) vulnerability exists in the BIG-IP ASM Configuration utility response and blocking pages. An authenticated user with administrative privileges can specify a res...Show more On BIG-IP ASM 15.1.0-15.1.0.5, a cross-site scripting (XSS) vulnerability exists in the BIG-IP ASM Configuration utility response and blocking pages. An authenticated user with administrative privileges can specify a response page with any content, including JavaScript code that will be executed when preview is opened.Show less
CVE-2020-21266 1Broadleafcommerce 1Broadleaf Commerce Jun 17, 2026 Oct 29, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Broadleaf Commerce 5.1.14-GA is affected by cross-site scripting (XSS) due to a slow HTTP post vulnerability.
CVE-2020-25516 1Wso2 1Enterprise Integrator Jun 17, 2026 Oct 29, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 WSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS) vulnerability in BPMN explorer tasks.
CVE-2020-24712 1Getgophish 1Gophish Jun 17, 2026 Oct 28, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.
CVE-2020-24709 1Getgophish 1Gophish Jun 17, 2026 Oct 28, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.
CVE-2020-24708 1Getgophish 1Gophish Jun 17, 2026 Oct 28, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.
CVE-2020-27980 1Genexis 1Platinum 4410 Firmware Jun 17, 2026 Oct 28, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Genexis Platinum-4410 P4410-V2-1.28 devices allow stored XSS in the WLAN SSID parameter. This could allow an attacker to perform malicious actions in which the XSS popup will affect all privileged users.
CVE-2020-27741 1Citadel 1Webcit Jun 17, 2026 Oct 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in Citadel WebCit through 926 allow remote attackers to inject arbitrary web script or HTML via multiple pages and parameters. NOTE: this was reported to the vendor in...Show more Multiple cross-site scripting (XSS) vulnerabilities in Citadel WebCit through 926 allow remote attackers to inject arbitrary web script or HTML via multiple pages and parameters. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.Show less
CVE-2018-19953 1Qnap 1Qts Oct 1, 2026 Oct 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.120...Show more If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.Show less
CVE-2018-19943 1Qnap 1Qts Aug 13, 2026 Oct 28, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS...Show more If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and laterShow less
CVE-2020-27974 1Quadient 1Mail Accounting Jun 17, 2026 Oct 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 NeoPost Mail Accounting Software Pro 5.0.6 allows php/Commun/FUS_SCM_BlockStart.php?code= XSS.
CVE-2020-24303 1Grafana 1Grafana Jun 17, 2026 Oct 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.

Previous 1...169816991700...2426 Next