CWE-79
48,513 CVEs • Abstraction: Base • Likelihood of Exploit: High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVEs (48,513)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Extremenetworks 1Extreme Management Center Jun 17, 2026 Aug 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request. |
A reflected Cross-site Scripting (XSS) vulnerability exists in OcPortal 9.0.20 via the OCF_EMOTICON_CELL.tpl FIELD_NAME field to data/emoticons.php. |
Wowza Streaming Engine before 4.8.5 allows XSS (issue 1 of 2). An authenticated user, with access to the proxy license editing is able to insert a malicious payload that will be triggered in the main page of server setti...Show more |
1Ibm 1Financial Transaction Manager Jun 17, 2026 Aug 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...Show more |
1Sonatype 2Nexus Repository Manager Nexus Repository Manager 3Sep 22, 2026 Jul 31, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2). |
1Sonatype 2Nexus Repository Manager Nexus Repository Manager 3Sep 22, 2026 Jul 31, 2020 N/A· v4 5.4 MEDIUM· v3 4.3 MEDIUM· v2 Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2). |
1Cisco 1Data Center Network Manager Jun 17, 2026 Jul 31, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the inter...Show more |
A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -> Email Users menu. |
2Ivanti Pulsesecure4Connect Secure Policy SecurePulse Connect Secure+1 moreJun 17, 2026 Jul 30, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A cross site scripting (XSS) vulnerability in Pulse Connect Secure <9.1R8 allowed attackers to exploit in the URL used for Citrix ICA. |
2Ivanti Pulsesecure4Connect Secure Policy SecurePulse Connect Secure+1 moreJun 17, 2026 Jul 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross site scripting (XSS) vulnerability exists in Pulse Connect Secure <9.1R5 on the PSAL Page. |
1Kitodo 1Kitodo.presentation Jun 17, 2026 Jul 29, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The dlf (aka Kitodo.Presentation) extension before 3.1.2 for TYPO3 allows XSS. |
IBM Planning Analytics Local 2.0.0 through 2.0.9.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentia...Show more |
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could lead to arbitrary code execution. |
1Openclinic Ga Project 1Openclinic Ga Jun 17, 2026 Jul 29, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 OpenClinic GA 5.09.02 and 5.89.05b does not properly neutralize user-controllable input, which may allow the execution of malicious code within the user’s browser. |
Cross-site scripting vulnerability in KonaWiki 3.1.0 and earlier allows remote attackers to execute an arbitrary script via a specially crafted URL. |
Cross-site scripting vulnerability in KonaWiki 2.2.0 and earlier allows remote attackers to execute an arbitrary script via a specially crafted URL. |
In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without aut...Show more |
Gambio GX before 4.0.1.0 allows XSS in admin/coupon_admin.php. |
1Ruckuswireless 1Unleashed Firmware Jun 17, 2026 Jul 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An XSS issue in emfd in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to execute JavaScript code via an unauthenticated crafted HTTP request. This affects C110, E510, H320, H510, M510, R320,...Show more |
1Ibm 3Intelligent Operations Center Intelligent Operations Center For Emergency ManagementWater Operations For WaternamicsJun 17, 2026 Jul 28, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics are vulnerable to cross-site scripting. This vulnerability allows users to embed a...Show more |