Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,507)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-24223 1Mara Cms Project 1Mara Cms Jun 17, 2026 Aug 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.
CVE-2020-24917 2Enhancesoft Osticket 2Osticket Osticket Jul 10, 2026 Aug 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php.
CVE-2020-24897 1Stiltsoft 1Table Filter And Charts For Confluence Server Jun 17, 2026 Aug 29, 2020 N/A· v4 8.9 HIGH· v3 3.5 LOW· v2 The Table Filter and Charts for Confluence Server app before 5.3.25 (for Atlassian Confluence) allow remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) through the provided Markdown ma...Show more The Table Filter and Charts for Confluence Server app before 5.3.25 (for Atlassian Confluence) allow remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) through the provided Markdown markup to the "Table from CSV" macro.Show less
CVE-2020-15159 1Basercms 1Basercms Jun 17, 2026 Aug 28, 2020 N/A· v4 7.6 HIGH· v3 4.6 MEDIUM· v2 baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP fil...Show more baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7.Show less
CVE-2020-15155 1Basercms 1Basercms Jun 17, 2026 Aug 28, 2020 N/A· v4 7.3 HIGH· v3 2.1 LOW· v2 baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components is toolbar.php. The issue is fixed in v...Show more baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components is toolbar.php. The issue is fixed in version 4.3.7.Show less
CVE-2020-15154 1Basercms 1Basercms Jun 17, 2026 Aug 28, 2020 N/A· v4 7.3 HIGH· v3 2.1 LOW· v2 baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components are: content_fields.php, content_info.p...Show more baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components are: content_fields.php, content_info.php, content_options.php, content_related.php, index_list_tree.php, jquery.bcTree.js. The issue is fixed in version 4.3.7.Show less
CVE-2020-5625 1Riken 1Xoonips Jun 17, 2026 Aug 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in XooNIps 3.48 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
CVE-2020-24706 1Wso2 6Api Manager Api Manager AnalyticsIdentity Server+3 more Jun 17, 2026 Aug 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10....Show more An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0.Show less
CVE-2020-24704 1Wso2 9Api Manager Api Manager AnalyticsApi Microgateway+6 more Jun 17, 2026 Aug 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integra...Show more An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integrator through 6.6.0, IS as Key Manager 5.5.0, Identity Server 5.5.0 and 5.8.0, Identity Server Analytics 5.5.0, and IoT Server 3.3.0 and 3.3.1.Show less
CVE-2020-24390 1Eyesofnetwork 1Eyesofnetwork Jun 17, 2026 Aug 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/admin_logs page, which might allow pre-authentication stored XSS during login/logout logs recording.
CVE-2020-23576 1Laborator 1Neon Jun 17, 2026 Aug 27, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab.
CVE-2020-23984 1Online Hotel Booking System Pro Project 1Online Hotel Booking System Pro Jun 17, 2026 Aug 27, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Online Hotel Booking System Pro PHP Version 1.3 has Persistent Cross-site Scripting in Customer registration-form all-tags.
CVE-2020-23983 1Ichat Project 1Ichat Jun 17, 2026 Aug 27, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Michael-design iChat Realtime PHP Live Support System 1.6 has persistent Cross-site Scripting via chat,text-filed tags.
CVE-2020-23982 1Designmasterevents 1Conference Management Cms Jun 17, 2026 Aug 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 DesignMasterEvents Conference management 1.0.0 has cross site scripting via the 'certificate.php'
CVE-2020-23981 113enforme 113enforme Cms Jun 17, 2026 Aug 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 13enforme CMS 1.0 has Cross Site Scripting via the "content.php" id parameter.
CVE-2020-23977 1Kandnconcepts Club Cms Project 1Kandnconcepts Club Cms Jun 17, 2026 Aug 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 KandNconcepts Club CMS 1.1 and 1.2 has cross site scripting via the 'team.php,player.php,club.php' id parameter.
CVE-2020-23975 1Webexcels 1Ecommerce Cms Jun 17, 2026 Aug 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has cross site scripting via the 'search.php' id parameter.
CVE-2020-23974 1Create Project Manager Project 1Create Project Manager Jun 17, 2026 Aug 27, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Message(title-tag), Add new client (all-tags).
CVE-2020-4575 1Ibm 2Websphere Application Server Websphere Virtual Enterprise Jun 17, 2026 Aug 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM WebSphere Application Server ND 8.5 and 9.0, and IBM WebSphere Virtual Enterprise 7.0 and 8.0 are vulnerable to cross-site scripting when High Availability Deployment Manager is configured.
CVE-2019-5320 1Arubanetworks 62530 Firmware 2540 Firmware2920 Firmware+3 more Jun 17, 2026 Aug 26, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 2930M, 2920, 5400R, and 3810M with firmware 16.08.* before 16.08.0009, 16.09.* before 16.09.0007, 16.10.* before 16.10.0003 are vulnerable to Cross Site Scripting i...Show more Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 2930M, 2920, 5400R, and 3810M with firmware 16.08.* before 16.08.0009, 16.09.* before 16.09.0007, 16.10.* before 16.10.0003 are vulnerable to Cross Site Scripting in the web UI, leading to injection of code.Show less

Previous 1...171617171718...2426 Next