CWE-79
48,503 CVEs • Abstraction: Base • Likelihood of Exploit: High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVEs (48,503)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Pulsesecure 1Pulse Secure Desktop Client Jun 17, 2026 Oct 28, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A vulnerability in the authenticated user web interface of Pulse Connect Secure < 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) through the CGI file. |
2Ivanti Pulsesecure4Connect Secure Policy SecurePulse Connect Secure+1 moreJun 17, 2026 Oct 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection for authenticated user web interface. |
The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data. When certain varieties of games were created within MediaWiki, their names or titles could be manipulated to g...Show more |
The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS. |
1Apple 6Icloud Ipad OsIphone Os+3 moreJun 17, 2026 Oct 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A validation issue was addressed with improved logic. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, iCloud for Windows 10.7, tvOS 13, iCloud for Windows 7.14, iTunes 12.10.1 for Windows. Processing mali...Show more |
1Apple 4Iphone Os Mac Os XTvos+1 moreJun 17, 2026 Oct 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15, watchOS 6, iOS 13, tvOS 13. Processing maliciously crafted web content may lead to a cross site scripting attack. |
Multiple cross-site scripting (XSS) vulnerabilities in konzept-ix publiXone before 2020.015 allow remote attackers to inject arbitrary JavaScript or HTML via appletError.jsp, job_jacket_detail.jsp, ixedit/editor_componen...Show more |
In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. While the title is properly escaped in both the navigation links and the actual page title, it is not...Show more |
A ZTE product is impacted by an XSS vulnerability. The vulnerability is caused by the lack of correct verification of client data in the WEB module. By inserting malicious scripts into the web module, a remote attacker c...Show more |
1Antsword Project 1Antsword Jun 17, 2026 Oct 26, 2020 N/A· v4 9.6 CRITICAL· v3 6.8 MEDIUM· v2 A cross-site scripting (XSS) vulnerability AntSword v2.0.7 can remotely execute system commands. |
AntSword 2.1.8.1 contains a cross-site scripting (XSS) vulnerability in the View Site funtion. When viewing an added site, an XSS payload can be injected in cookies view which can lead to remote code execution. |
Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multi...Show more |
VMware Horizon Server (7.x prior to 7.10.3 or 7.13.0) contains a Cross Site Scripting (XSS) vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which will be executed. |
1Open Xchange 1Open Xchange Appsuite Jun 17, 2026 Oct 23, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS. |
A cross-site scripting (XSS) vulnerability on Comtrend AR-5387un devices with A731-410JAZ-C04_R02.A2pD035g.d23i firmware allows remote attackers to inject arbitrary web script or HTML via the Service Description paramete...Show more |
Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature. |
A Cross Site Scripting (XSS) issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to inject code into web pages, and other users will be affected when viewing web pages. |
A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6. |
The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped. This is related to wfMessage and Html::rawElement, as demonstrated by CosmosSocialProfile::getUserGr...Show more |
WSO2 API Manager 3.1.0 and earlier has reflected XSS on the "publisher" component's admin interface. More precisely, it is possible to inject an XSS payload into the owner POST parameter, which does not filter user input...Show more |