Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,507)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-13972 1Enghouse 1Web Chat Jun 17, 2026 Sep 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Enghouse Web Chat 6.2.284.34 allows XSS. When one enters their own domain name in the WebServiceLocation parameter, the response from the POST request is displayed, and any JavaScript returned from the external server is...Show more Enghouse Web Chat 6.2.284.34 allows XSS. When one enters their own domain name in the WebServiceLocation parameter, the response from the POST request is displayed, and any JavaScript returned from the external server is executed in the browser. This is related to CVE-2019-16951.Show less
CVE-2020-12058 1Oscommerce 1Ce Phoenix Jun 17, 2026 Sep 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/or...Show more Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/order_status.php, catalog/admin/tax_rates.php, catalog/admin/languages.php, catalog/admin/countries.php, catalog/admin/tax_classes.php, catalog/admin/reviews.php, or catalog/admin/zones.php; or the zpage or spage parameter to catalog/admin/geo_zones.php.Show less
CVE-2020-25093 1Ecommerce Codeigniter Bootstrap Project 1Ecommerce Codeigniter Bootstrap Jun 17, 2026 Sep 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in blog.php. within application/views/templates/clothesshop, application/views/templates/onepage, and application/views/templates/redlabel.
CVE-2020-25092 1Ecommerce Codeigniter Bootstrap Project 1Ecommerce Codeigniter Bootstrap Jun 17, 2026 Sep 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in _parts/header.php, within application/views/templates/clothesshop, application/views/templates/greenlabel, and application/views/templates/redlabel.
CVE-2020-25091 1Ecommerce Codeigniter Bootstrap Project 1Ecommerce Codeigniter Bootstrap Jun 17, 2026 Sep 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/vendor/views/add_product.php.
CVE-2020-25090 1Ecommerce Codeigniter Bootstrap Project 1Ecommerce Codeigniter Bootstrap Jun 17, 2026 Sep 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/publish.php.
CVE-2020-25089 1Ecommerce Codeigniter Bootstrap Project 1Ecommerce Codeigniter Bootstrap Jun 17, 2026 Sep 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/discounts.php.
CVE-2020-25088 1Ecommerce Codeigniter Bootstrap Project 1Ecommerce Codeigniter Bootstrap Jun 17, 2026 Sep 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/blog/blogpublish.php.
CVE-2020-25087 1Ecommerce Codeigniter Bootstrap Project 1Ecommerce Codeigniter Bootstrap Jun 17, 2026 Sep 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/languages.php.
CVE-2020-25086 1Ecommerce Codeigniter Bootstrap Project 1Ecommerce Codeigniter Bootstrap Jun 17, 2026 Sep 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/adminUsers.php.
CVE-2020-4546 1Ibm 10Doors Next Engineering Requirements Management Doors NextEngineering Test Management+7 more Jun 17, 2026 Sep 2, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadin...Show more IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183314.Show less
CVE-2020-4522 1Ibm 10Doors Next Engineering Requirements Management Doors NextEngineering Test Management+7 more Jun 17, 2026 Sep 2, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadin...Show more IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182397.Show less
CVE-2020-4445 1Ibm 10Doors Next Engineering Requirements Management Doors NextEngineering Test Management+7 more Jun 17, 2026 Sep 2, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadin...Show more IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 181122.Show less
CVE-2020-24553 4Fedoraproject GolangOpensuse+1 more 4Communications Cloud Native Core Policy FedoraGo+1 more Jun 17, 2026 Sep 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
CVE-2020-24604 1Igniterealtime 1Openfire Jun 17, 2026 Sep 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows remote attackers to inject arbitrary web script or HTML via the GET request "searchName", "searchValue"...Show more A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows remote attackers to inject arbitrary web script or HTML via the GET request "searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescription" and "searchDynamic" in server-properties.jsp and security-audit-viewer.jspShow less
CVE-2020-24602 1Igniterealtime 1Openfire Jun 17, 2026 Sep 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter searchName", "searchValue", "searchDescriptio...Show more Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescription" and "searchDynamic" in the Server Properties and Security Audit Viewer JSP pageShow less
CVE-2020-24601 1Igniterealtime 1Openfire Jun 17, 2026 Sep 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious URL via the vulnerable POST parameter searchName", "alias" in the import certificate trusted page
CVE-2020-17458 1Fabbricadigitale 1Multiux Jun 17, 2026 Sep 2, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A post-authenticated stored XSS was found in MultiUx v.3.1.12.0 via the /multiux/SaveMailbox LastName field.
CVE-2020-16210 1Redlion 2N Tron 702 W Firmware N Tron 702m12 W Firmware Jun 17, 2026 Sep 1, 2020 N/A· v4 9.0 CRITICAL· v3 3.5 LOW· v2 The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute arbitrary code and perform actions in the context of an attacked user on the N-Tron 702-W / 702M12-W (...Show more The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute arbitrary code and perform actions in the context of an attacked user on the N-Tron 702-W / 702M12-W (all versions).Show less
CVE-2020-16206 1Redlion 2N Tron 702 W Firmware N Tron 702m12 W Firmware Jun 17, 2026 Sep 1, 2020 N/A· v4 9.0 CRITICAL· v3 3.5 LOW· v2 The affected product is vulnerable to stored cross-site scripting, which may allow an attacker to remotely execute arbitrary code to gain access to sensitive data on the N-Tron 702-W / 702M12-W (all versions).

Previous 1...171417151716...2426 Next