← Back
CWE-79

48,507 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,507)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-23839
1Get Simple
1Getsimple Cms
Jun 17, 2026
Sep 1, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login cre...Show more
A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the login form.Show less
CVE-2020-23835
1Tailor Management System Project
1Tailor Management System
Jun 17, 2026
Sep 1, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Tailor Management System v1.0 allows remote attackers to harvest keys pressed by an unauthenticated victim who...Show more
A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Tailor Management System v1.0 allows remote attackers to harvest keys pressed by an unauthenticated victim who clicks on a malicious URL and begins typing.Show less
CVE-2020-23831
1Stock Management System Project
1Stock Management System
Jun 17, 2026
Sep 1, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Stock Management System v1.0 allows remote attackers to harvest login credentials and session cookies when an u...Show more
A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Stock Management System v1.0 allows remote attackers to harvest login credentials and session cookies when an unauthenticated victim clicks on a malicious URL and enters credentials.Show less
CVE-2012-3341
1Ibm
1Infosphere Guardium
Nov 21, 2024
Sep 1, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM InfoSphere Guardium 7.0, 8.0, 8.01, and 8.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted UR...Show more
IBM InfoSphere Guardium 7.0, 8.0, 8.01, and 8.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 78294.Show less
CVE-2020-23450
1Spiceworks
1Spiceworks
Jul 9, 2026
Sep 1, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Spiceworks Version <= 7.5.00107 is affected by XSS. Any name typed on Custom Groups function is vulnerable to stored XSS as they displayed on http://127.0.0.1/inventory/groups/ without output sanitization.
CVE-2020-2248
1Jenkins
1Jsgames
Jun 17, 2026
Sep 1, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Jenkins JSGames Plugin 0.2 and earlier evaluates part of a URL as code, resulting in a reflected cross-site scripting (XSS) vulnerability.
CVE-2020-2246
1Jenkins
1Valgrind
Jun 17, 2026
Sep 1, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Jenkins Valgrind Plugin 0.28 and earlier does not escape content in Valgrind XML reports, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Valgrind XML report conten...Show more
Jenkins Valgrind Plugin 0.28 and earlier does not escape content in Valgrind XML reports, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Valgrind XML report contents.Show less
CVE-2020-2244
1Jenkins
1Build Failure Analyzer
Jun 17, 2026
Sep 1, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide conso...Show more
Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide console output for builds used to test build log indications.Show less
CVE-2020-2243
1Jenkins
1Cadence Vmanager
Jun 17, 2026
Sep 1, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Jenkins Cadence vManager Plugin 3.0.4 and earlier does not escape build descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.
CVE-2020-2238
1Jenkins
1Git Parameter
Jun 17, 2026
Sep 1, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/C...Show more
Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.Show less
CVE-2020-20628
1Appsaloon
1Wp Gdpr
Jun 17, 2026
Aug 31, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
controller/controller-comments.php in WP GDPR plugin through 2.1.1 has unauthenticated stored XSS.
CVE-2020-24699
1Chamber Dashboard Business Directory Project
1Chamber Dashboard Business Directory
Jun 17, 2026
Aug 31, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.
CVE-2020-20626
1Lara's Google Analytics Project
1Lara's Google Analytics
Jun 17, 2026
Aug 31, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS.
CVE-2020-17465
1Forgerock
1Identity Manager
Jun 17, 2026
Aug 31, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS. The vulnerability affects versions 6.5.0.4, 6.0.0.6.
CVE-2020-13828
1Dolibarr
1Dolibarr Erp/crm
Jun 17, 2026
Aug 31, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via ticket/card.php?action=create with the...Show more
Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via ticket/card.php?action=create with the subject, message, or address parameter; adherents/card.php with the societe or address parameter; product/card.php with the label or customcode parameter; or societe/card.php with the alias or barcode parameter.Show less
CVE-2020-13655
1O Dyn
1Collabtive
Jun 17, 2026
Aug 31, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Collabtive 3.0 and later. managefile.php is vulnerable to XSS: when the action parameter is set to movefile and the id parameter corresponds to a project the current user has access to, the fil...Show more
An issue was discovered in Collabtive 3.0 and later. managefile.php is vulnerable to XSS: when the action parameter is set to movefile and the id parameter corresponds to a project the current user has access to, the file and target parameters are reflected.Show less
CVE-2020-12646
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Aug 31, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document.
CVE-2020-15020
1Elementor
1Website Builder
Jun 17, 2026
Aug 31, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name Your Template field.
CVE-2020-25033
1Blubrry
1Subscribe Sidebar
Jun 17, 2026
Aug 31, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS.
CVE-2020-24104
1Pix Link
1Lv Wr07 Firmware
Jun 17, 2026
Aug 30, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
XSS on the PIX-Link Repeater/Router LV-WR07 with firmware v28K.Router.20170904 allows attackers to steal credentials without being connected to the network. The attack vector is a crafted ESSID, as demonstrated by the wi...Show more
XSS on the PIX-Link Repeater/Router LV-WR07 with firmware v28K.Router.20170904 allows attackers to steal credentials without being connected to the network. The attack vector is a crafted ESSID, as demonstrated by the wireless.htm SET2 parameter.Show less