CWE-79
48,509 CVEs • Abstraction: Base • Likelihood of Exploit: High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVEs (48,509)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Galileo Cms Project 1Galileo Cms Jun 17, 2026 Aug 14, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 There is stored cross site scripting (XSS) in Galileo CMS v0.042. Remote authenticated users could inject arbitrary web script or HTML via $page_title in /lib/Galileo/files/templates/page/show.html.ep (aka the PAGE TITLE...Show more |
A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term...Show more |
For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting (XSS) vulnerability exists in the issue reference number tooltip. |
For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in the issues list via milestone title. |
1Intel 18Compute Module Hns2600bp Firmware Compute Module Hns2600kp FirmwareCompute Module Hns2600tp Firmware+15 moreJun 17, 2026 Aug 13, 2020 N/A· v4 6.3 MEDIUM· v3 5.4 MEDIUM· v2 Cross-site scripting for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. |
Cross Site scripting vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated remote user to trigger scripts to run in a user's browser via adding a new label. |
Cross Site scripting vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated attackers to trigger alerts via the file upload tab in the DLP case management section. |
PHP-Fusion 9.03 allows XSS on the preview page. |
PHP-Fusion 9.03 allows XSS via the error_log file. |
search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS. |
In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs page |
1Sap 1Businessobjects Business Intelligence Platform Jun 17, 2026 Aug 12, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 SAP Business Objects Business Intelligence Platform (Central Management Console), versions- 4.2, 4.3, allows an attacker with administrator rights can use the web application to send malicious code to a different end use...Show more |
1Sap 1Netweaver Knowledge Management Jun 17, 2026 Aug 12, 2020 N/A· v4 9.0 CRITICAL· v3 8.5 HIGH· v2 SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file due to inadequate filtering with the accessing user's privileges. If the accessin...Show more |
1Jenkins 1Yet Another Build Visualizer Jun 17, 2026 Aug 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Yet Another Build Visualizer Plugin 1.11 and earlier does not escape tooltip content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Run/Update permission. |
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable...Show more |
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permissi...Show more |
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability. |
1Rosariosis 1Student Information System Jun 17, 2026 Aug 12, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to execute arbitrary web script via embedding javascript or HTML tags in a GET request. |
SugarCRM before 10.1.0 (Q3 2020) allows XSS. |
An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on view_all_bug_page.php allows a remote attacker to inject arbitrary HTML into the page by saving it into a text Custom Field, leading to possible...Show more |