Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,504)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-5785 1Teltonika Networks 1Trb245 Firmware Jun 17, 2026 Oct 1, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient output sanitization in Teltonika firmware TRB2_R_00.02.04.3 allows an unauthenticated attacker to conduct reflected cross-site scripting via a crafted ‘action’ or ‘pkg_name’ parameter.
CVE-2020-14223 1Hcltech 1Digital Experience Jun 17, 2026 Oct 1, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS). The vulnerability could be employed in a reflected or non-persistent XSS attack.
CVE-2020-15676 3Debian MozillaOpensuse 5Debian Linux FirefoxFirefox Esr+2 more Jun 17, 2026 Oct 1, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. This vulne...Show more Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.Show less
CVE-2019-19393 1Rittal 1Cmc Pu Iii 7030.000 Firmware Jun 17, 2026 Oct 1, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browse...Show more The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browser-interpreted content (such as JavaScript or other client-side scripts) as the content is always displayed after and before login. Persistent XSS allows an attacker to modify displayed content or to change the victim's information. Successful exploitation requires access to the web management interface, either with valid credentials or a hijacked session.Show less
CVE-2020-24861 1Get Simple 1Getsimple Cms Jun 17, 2026 Oct 1, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create and open a new page
CVE-2020-24860 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Oct 1, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user wh...Show more CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.Show less
CVE-2019-20903 1Atlassian 1Editor Core Jun 17, 2026 Oct 1, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in link targets.
CVE-2020-25830 1Mantisbt 1Mantisbt Jun 17, 2026 Sep 30, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when attempting to up...Show more An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when attempting to update said custom field via bug_actiongroup_page.php.Show less
CVE-2020-25288 1Mantisbt 1Mantisbt Jun 17, 2026 Sep 30, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of the corresponding form input's pattern a...Show more An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of the corresponding form input's pattern attribute allows HTML injection and, if CSP settings permit, execution of arbitrary JavaScript.Show less
CVE-2020-13336 1Gitlab 1Gitlab Jun 17, 2026 Sep 30, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue has been discovered in GitLab affecting versions from 11.8 before 12.10.13. GitLab was vulnerable to a stored XSS by in the error tracking feature.
CVE-2020-12869 1Rainbowfishsoftware 1Pacsone Server Jun 17, 2026 Sep 30, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 RainbowFish PacsOne Server 6.8.4 allows XSS.
CVE-2020-25626 3Debian EncodeRedhat 3Ceph Storage Debian LinuxDjango Rest Framework Jun 17, 2026 Sep 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This...Show more A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.Show less
CVE-2020-8238 2Ivanti Pulsesecure 4Connect Secure Policy SecurePulse Connect Secure+1 more Jun 17, 2026 Sep 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS).
CVE-2020-26158 1Leanote 1Leanote Jun 17, 2026 Sep 30, 2020 N/A· v4 9.6 CRITICAL· v3 6.8 MEDIUM· v2 Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered. This leads to remote code execution because of Node integration.
CVE-2020-26157 1Leanote 1Leanote Jun 17, 2026 Sep 30, 2020 N/A· v4 9.6 CRITICAL· v3 6.8 MEDIUM· v2 Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing. This leads to remote code execution because of Node integration.
CVE-2020-26043 1Hoosk 1Hoosk Jun 17, 2026 Sep 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Hoosk CMS v1.8.0. There is a XSS vulnerability in install/index.php
CVE-2020-25761 1Projectworlds 1Visitor Management System Jun 17, 2026 Sep 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request parameters. An attacker can inject javascript payloads in the parameters to perform vari...Show more Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request parameters. An attacker can inject javascript payloads in the parameters to perform various attacks such as stealing of cookies,sensitive information etc.Show less
CVE-2020-22842 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Sep 30, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php.
CVE-2020-22481 1Hack 1Hfish Jun 17, 2026 Sep 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in HFish 0.5.1. When a payload is inserted where the password is entered, XSS code is triggered when the administrator views the information.
CVE-2020-13331 1Gitlab 1Gitlab Jun 17, 2026 Sep 30, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the Wiki pasges.

Previous 1...170517061707...2426 Next