Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,504)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-15177 1Glpi Project 1Glpi Jun 17, 2026 Oct 7, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_base` and `url_base_api`. These settings are referenced throughout the application and allow for vul...Show more In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_base` and `url_base_api`. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure Redirection Since authentication is not required to perform these changes,anyone could point these fields at malicious websites or form input in a way to trigger XSS. Leveraging JavaScript it's possible to steal cookies, perform actions as the user, etc. The issue is patched in version 9.5.2.Show less
CVE-2020-17551 1Impresscms 1Impresscms Jun 17, 2026 Oct 7, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.
CVE-2020-26870 4Cure53 DebianMicrosoft+1 more 5Application Express Debian LinuxDompurify+2 more Jun 17, 2026 Oct 7, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by ne...Show more Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.Show less
CVE-2020-25343 1Getsymphony 1Symphony Jun 17, 2026 Oct 7, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML to fields['body'] param via events\event.publish_article.php
CVE-2020-13345 1Gitlab 1Gitlab Jun 17, 2026 Oct 6, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue has been discovered in GitLab affecting all versions starting from 10.8. Reflected XSS on Multiple Routes
CVE-2019-4725 1Ibm 1Security Access Manager Jun 17, 2026 Oct 6, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Security Access Manager Appliance 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadi...Show more IBM Security Access Manager Appliance 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 172131.Show less
CVE-2020-7741 1Hello.js Project 1Hello.js Jun 17, 2026 Oct 6, 2020 N/A· v4 9.9 CRITICAL· v3 7.5 HIGH· v2 This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param...Show more This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).Show less
CVE-2020-26574 1Leostream 1Connection Broker Jun 17, 2026 Oct 6, 2020 N/A· v4 9.6 CRITICAL· v3 9.3 HIGH· v2 Leostream Connection Broker 8.2.x is affected by stored XSS. An unauthenticated attacker can inject arbitrary JavaScript code via the webquery.pl User-Agent HTTP header. It is rendered by the admins the next time they lo...Show more Leostream Connection Broker 8.2.x is affected by stored XSS. An unauthenticated attacker can inject arbitrary JavaScript code via the webquery.pl User-Agent HTTP header. It is rendered by the admins the next time they log in. The JavaScript injected can be used to force the admin to upload a malicious Perl script that will be executed as root via libMisc::browser_client. NOTE: This vulnerability only affects products that are no longer supported by the maintainerShow less
CVE-2020-23832 1Car Rental Management System Project 1Car Rental Management System Jun 17, 2026 Oct 6, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Persistent Cross-Site Scripting (XSS) vulnerability in message_admin.php in Projectworlds Car Rental Management System v1.0 allows unauthenticated remote attackers to harvest an admin login session cookie and steal an...Show more A Persistent Cross-Site Scripting (XSS) vulnerability in message_admin.php in Projectworlds Car Rental Management System v1.0 allows unauthenticated remote attackers to harvest an admin login session cookie and steal an admin session upon an admin login.Show less
CVE-2020-5631 1Cmonos 1Cmonos Jun 17, 2026 Oct 6, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Stored cross-site scripting vulnerability in CMONOS.JP ver2.0.20191009 and earlier allows remote attackers to inject arbitrary script via unspecified vectors.
CVE-2020-26166 1Qdpm 1Qdpm Jun 17, 2026 Oct 5, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS. This can occur during cr...Show more The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS. This can occur during creation of a ticket, project, or task.Show less
CVE-2020-15231 1Mapfish 1Print Jun 17, 2026 Oct 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.
CVE-2020-13338 1Gitlab 1Gitlab Jun 17, 2026 Oct 2, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue has been discovered in GitLab affecting versions prior to 12.10.13, 13.0.8, 13.1.2. A stored cross-site scripting vulnerability was discovered when editing references.
CVE-2020-13337 1Gitlab 1Gitlab Jun 17, 2026 Oct 2, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue has been discovered in GitLab affecting versions from 12.10 to 12.10.12 that allowed for a stored XSS payload to be added as a group name.
CVE-2020-24627 1Hpe 1Kvm Ip Console Switch G2 Firmware Jun 17, 2026 Oct 2, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A remote stored xss vulnerability was discovered in HPE KVM IP Console Switches version(s): G2 4x1Ex32 Prior to 2.8.3.
CVE-2020-26135 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Oct 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO.
CVE-2020-26134 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Oct 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via BBCode.
CVE-2020-14294 1Secudos 1Qiata Fta Jun 17, 2026 Oct 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when reading transfer comments or the global notice board.
CVE-2020-13168 1Sysaid 2Sysaid On Premises Sysaidsy On Premises Jun 17, 2026 Oct 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter.
CVE-2020-26523 1Froala 1Froala Editor Jun 17, 2026 Oct 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Froala Editor before 3.2.2 allows XSS via pasted content.

Previous 1...170417051706...2426 Next