← Back
CWE-79

48,509 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,509)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-16145
2Fedoraproject
Roundcube
2Fedora
Webmail
Jun 17, 2026
Aug 12, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15.
CVE-2020-15071
1Getsymphony
1Symphony
Jun 17, 2026
Aug 11, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
content/content.blueprintsevents.php in Symphony CMS 3.0.0 allows XSS via fields['name'] to appendSubheading.
CVE-2020-13176
1Teradici
2Cloud Access Connector
Cloud Access Connector Legacy
Jun 17, 2026
Aug 11, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 24, 2020 (v16 and earlier for the Cloud Access Connector) contains a stored cross-site scripti...Show more
The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 24, 2020 (v16 and earlier for the Cloud Access Connector) contains a stored cross-site scripting (XSS) vulnerability which allows a remote unauthenticated attacker to poison log files with malicious JavaScript via the login page which is executed when an administrator views the logs within the application.Show less
CVE-2020-15597
1Soplanning
1Soplanning
Jun 17, 2026
Aug 11, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field.
CVE-2020-10777
1Redhat
1Cloudforms
Jun 17, 2026
Aug 11, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A cross-site scripting flaw was found in Report Menu feature of Red Hat CloudForms 4.7 and 5. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms.
CVE-2020-16278
1Carson Saint
1Saint Security Suite
Jun 17, 2026
Aug 10, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A cross-site scripting (XSS) vulnerability in the Permissions component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a speciall...Show more
A cross-site scripting (XSS) vulnerability in the Permissions component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link.Show less
CVE-2020-16275
1Carson Saint
1Saint Security Suite
Jun 17, 2026
Aug 10, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A cross-site scripting (XSS) vulnerability in the Credential Manager component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a s...Show more
A cross-site scripting (XSS) vulnerability in the Credential Manager component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link.Show less
CVE-2020-15139
1Mybb
1Mybb
Jun 17, 2026
Aug 10, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In MyBB before version 1.8.24, the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. The weakness can be exploited by pointing a v...Show more
In MyBB before version 1.8.24, the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. The weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously saved malicious message is quoted. After upgrading MyBB to 1.8.24, make sure to update the version attribute in the `codebuttons` template for non-default themes to serve the latest version of the patched `jscripts/bbcodes_sceditor.js` file.Show less
CVE-2020-17480
1Tiny
1Tinymce
Jun 17, 2026
Aug 10, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.
CVE-2020-17476
1Mibew
1Messenger
Jun 17, 2026
Aug 10, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Mibew Messenger before 3.2.7 allows XSS via a crafted user name.
CVE-2020-4541
1Ibm
1Jazz Reporting Service
Jun 17, 2026
Aug 10, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM Jazz Reporting Service 7.0 and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadin...Show more
IBM Jazz Reporting Service 7.0 and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183039.Show less
CVE-2020-4539
1Ibm
1Jazz Reporting Service
Jun 17, 2026
Aug 10, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM Jazz Reporting Service 6.0.2, 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended function...Show more
IBM Jazz Reporting Service 6.0.2, 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.Show less
CVE-2020-4533
1Ibm
1Jazz Reporting Service
Jun 17, 2026
Aug 10, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentia...Show more
IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182717.Show less
CVE-2020-12779
1Combodo
1Itop
Jun 17, 2026
Aug 10, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script.
CVE-2020-12778
1Combodo
1Itop
Jun 17, 2026
Aug 10, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.
CVE-2020-17451
1Flatcore
1Flatcore
Jun 17, 2026
Aug 9, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title, page_content, or page_extracontent parameter, or the acp/acp.php?tn=system&sub=sys_pref prefs_pagen...Show more
flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title, page_content, or page_extracontent parameter, or the acp/acp.php?tn=system&sub=sys_pref prefs_pagename, prefs_pagetitle, or prefs_pagesubtitle parameter.Show less
CVE-2020-15831
1Jetbrains
1Teamcity
Jun 17, 2026
Aug 8, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI.
CVE-2020-15830
1Jetbrains
1Teamcity
Jun 17, 2026
Aug 8, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI.
CVE-2020-15064
1Digitus
1Da 70254 Firmware
Jun 17, 2026
Aug 7, 2020
N/A· v4
4.3 MEDIUM· v3
2.3 LOW· v2
DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.
CVE-2020-15060
1Lindy International
142633 Firmware
Jun 17, 2026
Aug 7, 2020
N/A· v4
4.3 MEDIUM· v3
2.3 LOW· v2
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.