← Back
CWE-79

48,507 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,507)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-6312
1Sap
1Businessobjects Business Intelligence Platform
Jun 17, 2026
Sep 9, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), versions - 4.1, 4.2, allows an attacker with a non-administrative user account that can edit certain web page properties, can modify h...Show more
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), versions - 4.1, 4.2, allows an attacker with a non-administrative user account that can edit certain web page properties, can modify how a browser processes particular page elements, leading to stored Cross Site Scripting. In certain situations, when a user accesses an affected web page element, the attacker will be able to access or modify metadata for which they are not authorized.Show less
CVE-2020-6283
1Sap
1Fiori Launchpad
Jun 17, 2026
Sep 9, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
SAP Fiori Launchpad does not sufficiently encode user controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, resulting in reflected Cross-Site Sc...Show more
SAP Fiori Launchpad does not sufficiently encode user controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, resulting in reflected Cross-Site Scripting (XSS) vulnerability. With a successful attack, the attacker can steal authentication information of the user, such as data relating to his or her current session.Show less
CVE-2020-4698
1Ibm
2Business Automation Workflow
Business Process Manager
Jun 17, 2026
Sep 8, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web...Show more
IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186841.Show less
CVE-2020-4516
1Ibm
2Business Automation Workflow
Business Process Manager
Jun 17, 2026
Sep 8, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu...Show more
IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182371.Show less
CVE-2020-24963
1Appsbd
1Best Support System
Jun 17, 2026
Sep 4, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An Authenticated Persistent XSS vulnerability was discovered in the Best Support System, tested version v3.0.4.
CVE-2020-4702
1Ibm
1Infosphere Information Server
Jun 17, 2026
Sep 4, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially l...Show more
IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187187.Show less
CVE-2019-11928
1Whatsapp
1Whatsapp Desktop
Jun 17, 2026
Sep 3, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An input validation issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed cross-site scripting upon clicking on a link from a specially crafted live location message.
CVE-2020-25124
1Vbulletin
1Vbulletin
Jun 17, 2026
Sep 3, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI.
CVE-2020-25123
1Vbulletin
1Vbulletin
Jun 17, 2026
Sep 3, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager.
CVE-2020-25122
1Vbulletin
1Vbulletin
Jun 17, 2026
Sep 3, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager.
CVE-2020-25121
1Vbulletin
1Vbulletin
Jun 17, 2026
Sep 3, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options.
CVE-2020-25120
1Vbulletin
1Vbulletin
Jun 17, 2026
Sep 3, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI.
CVE-2020-25119
1Vbulletin
1Vbulletin
Jun 17, 2026
Sep 3, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual.
CVE-2020-25118
1Vbulletin
1Vbulletin
Jun 17, 2026
Sep 3, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager.
CVE-2020-25117
1Vbulletin
1Vbulletin
Jun 17, 2026
Sep 3, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager.
CVE-2020-25116
1Vbulletin
1Vbulletin
Jun 17, 2026
Sep 3, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager.
CVE-2020-25115
1Vbulletin
1Vbulletin
Jun 17, 2026
Sep 3, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager.
CVE-2020-25102
1Advanced Reports Project
1Advanced Reports
Jun 17, 2026
Sep 3, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
silverstripe-advancedreports (aka the Advanced Reports module for SilverStripe) 1.0 through 2.0 is vulnerable to Cross-Site Scripting (XSS) because it is possible to inject and store malicious JavaScript code. The affect...Show more
silverstripe-advancedreports (aka the Advanced Reports module for SilverStripe) 1.0 through 2.0 is vulnerable to Cross-Site Scripting (XSS) because it is possible to inject and store malicious JavaScript code. The affects admin/advanced-reports/DataObjectReport/EditForm/field/DataObjectReport/item (aka report preview) when an SVG document is provided in the Description parameter.Show less
CVE-2020-23814
1Xuxueli
1Xxl Job
Jun 17, 2026
Sep 3, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file.
CVE-2020-25104
1Eramba
1Eramba
Jun 17, 2026
Sep 3, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
eramba c2.8.1 and Enterprise before e2.19.3 allows XSS via a crafted filename for a file attached to an object. For example, the filename has a complete XSS payload followed by the .png extension.