Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,513)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-15831 1Jetbrains 1Teamcity Jun 17, 2026 Aug 8, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI.
CVE-2020-15830 1Jetbrains 1Teamcity Jun 17, 2026 Aug 8, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI.
CVE-2020-15064 1Digitus 1Da 70254 Firmware Jun 17, 2026 Aug 7, 2020 N/A· v4 4.3 MEDIUM· v3 2.3 LOW· v2 DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.
CVE-2020-15060 1Lindy International 142633 Firmware Jun 17, 2026 Aug 7, 2020 N/A· v4 4.3 MEDIUM· v3 2.3 LOW· v2 Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.
CVE-2020-15056 1Tp Link 1Tl Ps310u Firmware Jun 17, 2026 Aug 7, 2020 N/A· v4 4.3 MEDIUM· v3 2.3 LOW· v2 TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.
CVE-2020-15907 1Mahara 1Mahara Jun 17, 2026 Aug 7, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In Mahara 19.04 before 19.04.6, 19.10 before 19.10.4, and 20.04 before 20.04.1, certain places could execute file or folder names containing JavaScript.
CVE-2020-15138 1Prismjs 1Previewers Jun 17, 2026 Aug 7, 2020 N/A· v4 7.5 HIGH· v3 2.6 LOW· v2 Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari a...Show more Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the _Previewers_ plugin (>=v1.10.0) or the _Previewer: Easing_ plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.Show less
CVE-2020-9036 1Jeedom 1Jeedom Jun 17, 2026 Aug 5, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Jeedom through 4.0.38 allows XSS.
CVE-2020-16192 1Limesurvey 1Limesurvey Jun 17, 2026 Aug 5, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 LimeSurvey 4.3.2 allows reflected XSS because application/controllers/LSBaseController.php lacks code to validate parameters.
CVE-2020-17364 1Usvn 1User Friendly Svn Jun 17, 2026 Aug 5, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 USVN (aka User-friendly SVN) before 1.0.9 allows XSS via SVN logs.
CVE-2020-13819 1Extremenetworks 1Extreme Management Center Jun 17, 2026 Aug 5, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Extreme EAC Appliance 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.
CVE-2020-16847 1Extremenetworks 1Extreme Management Center Jun 17, 2026 Aug 4, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Extreme Analytics in Extreme Management Center before 8.5.0.169 allows unauthenticated reflected XSS via a parameter in a GET request, aka CFD-4887.
CVE-2020-15944 1Gantt Chart Project 1Gantt Chart Jun 17, 2026 Aug 4, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in the Gantt-Chart module before 5.5.5 for Jira. Due to missing validation of user input, it is vulnerable to a persistent XSS attack. An attacker can embed the attack vectors in the dashboard of...Show more An issue was discovered in the Gantt-Chart module before 5.5.5 for Jira. Due to missing validation of user input, it is vulnerable to a persistent XSS attack. An attacker can embed the attack vectors in the dashboard of other users. To exploit this vulnerability, an attacker has to be authenticated.Show less
CVE-2020-15943 1Gantt Chart Project 1Gantt Chart Jun 17, 2026 Aug 4, 2020 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 An issue was discovered in the Gantt-Chart module before 5.5.4 for Jira. Due to a missing privilege check, it is possible to read and write to the module configuration of other users. This can also be used to deliver an...Show more An issue was discovered in the Gantt-Chart module before 5.5.4 for Jira. Due to a missing privilege check, it is possible to read and write to the module configuration of other users. This can also be used to deliver an XSS payload to other users' dashboards. To exploit this vulnerability, an attacker has to be authenticated.Show less
CVE-2020-4542 1Ibm 1Engineering Requirements Management Doors Next Jun 17, 2026 Aug 4, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potential...Show more IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-force ID: 183046.Show less
CVE-2020-4525 1Ibm 2Engineering Workflow Management Rational Rhapsody Design Manager Jun 17, 2026 Aug 4, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potential...Show more IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182435.Show less
CVE-2020-4396 1Ibm 1Engineering Test Management Jun 17, 2026 Aug 4, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potential...Show more IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 179359.Show less
CVE-2020-11584 1Plesk 1Onyx Jun 17, 2026 Aug 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
CVE-2020-11583 1Plesk 1Obsidian Jun 17, 2026 Aug 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
CVE-2020-16131 1Tiki 1Tiki Jun 17, 2026 Aug 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Tiki before 21.2 allows XSS because [\s\/"\'] is not properly considered in lib/core/TikiFilter/PreventXss.php.

Previous 1...172217231724...2426 Next