Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,516)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-10985 1Gambio 1Gambio Gx Jun 17, 2026 Jul 28, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Gambio GX before 4.0.1.0 allows XSS in admin/coupon_admin.php.
CVE-2020-13913 1Ruckuswireless 1Unleashed Firmware Jun 17, 2026 Jul 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An XSS issue in emfd in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to execute JavaScript code via an unauthenticated crafted HTTP request. This affects C110, E510, H320, H510, M510, R320,...Show more An XSS issue in emfd in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to execute JavaScript code via an unauthenticated crafted HTTP request. This affects C110, E510, H320, H510, M510, R320, R310, R500, R510 R600, R610, R710, R720, R750, T300, T301n, T301s, T310c, T310d, T310n, T310s, T610, T710, and T710s devices.Show less
CVE-2020-4318 1Ibm 3Intelligent Operations Center Intelligent Operations Center For Emergency ManagementWater Operations For Waternamics Jun 17, 2026 Jul 28, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics are vulnerable to cross-site scripting. This vulnerability allows users to embed a...Show more IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 177356.Show less
CVE-2020-4317 1Ibm 3Intelligent Operations Center Intelligent Operations Center For Emergency ManagementWater Operations For Waternamics Jun 17, 2026 Jul 28, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics are vulnerable to cross-site scripting. This vulnerability allows users to embed a...Show more IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 177355.Show less
CVE-2020-10643 1Osisoft 1Pi Vision Jun 17, 2026 Jul 27, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An authenticated remote attacker could use specially crafted URLs to send a victim using PI Vision 2019 mobile to a vulnerable web page due to a known issue in a third-party component.
CVE-2020-7017 2Elasticsearch Oracle 4Communications Billing And Revenue Management Communications Cloud Native Core Network Function Cloud Native EnvironmentKibana+1 more Jun 17, 2026 Jul 27, 2020 N/A· v4 6.7 MEDIUM· v3 4.6 MEDIUM· v2 In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS flaw. An attacker who is able to edit or create a region map visualization could obtain sensitive information or perform de...Show more In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS flaw. An attacker who is able to edit or create a region map visualization could obtain sensitive information or perform destructive actions on behalf of Kibana users who view the region map visualization.Show less
CVE-2020-11110 2Grafana Netapp 2E Series Performance Analyzer Grafana Jun 17, 2026 Jul 27, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard af...Show more Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.Show less
CVE-2020-10614 1Osisoft 1Pi Vision Jun 17, 2026 Jul 25, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 In OSIsoft PI System multiple products and versions, an authenticated remote attacker with write access to PI Vision databases could inject code into a display. Unauthorized information disclosure, deletion, or modificat...Show more In OSIsoft PI System multiple products and versions, an authenticated remote attacker with write access to PI Vision databases could inject code into a display. Unauthorized information disclosure, deletion, or modification is possible if a victim views the infected display.Show less
CVE-2020-14175 1Atlassian 2Confluence Data Center Confluence Server Jun 17, 2026 Jul 24, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in user macro parameters. The affected version...Show more Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in user macro parameters. The affected versions are before version 7.4.2, and from version 7.5.0 before 7.5.2.Show less
CVE-2020-15919 1Midasolutions 1Eframework Jun 17, 2026 Jul 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Reflected Cross Site Scripting (XSS) vulnerability was discovered in Mida eFramework through 2.9.0.
CVE-2020-15918 1Midasolutions 1Eframework Jun 17, 2026 Jul 24, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Multiple Stored Cross Site Scripting (XSS) vulnerabilities were discovered in Mida eFramework through 2.9.0.
CVE-2019-18834 1Woocommerce 1Subscriptions Jun 17, 2026 Jul 23, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCS_Admin_Post_Types in class-wcs-admin-...Show more Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCS_Admin_Post_Types in class-wcs-admin-post-types.php.Show less
CVE-2020-4447 1Ibm 1Filenet Content Manager Jun 17, 2026 Jul 23, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM FileNet Content Manager 5.5.3 and 5.5.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lea...Show more IBM FileNet Content Manager 5.5.3 and 5.5.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 181227.Show less
CVE-2020-15885 1Munkireport Project 1Comment Jun 17, 2026 Jul 23, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A Cross-Site Scripting (XSS) vulnerability in the comment module before 4.0 for MunkiReport allows remote attackers to inject arbitrary web script or HTML by posting a new comment.
CVE-2020-15883 1Managedinstalls Project 1Managedinstalls Jun 17, 2026 Jul 23, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters (through which installed...Show more A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters (through which installed packages names and versions are reported).Show less
CVE-2020-15881 1Munki Facts Project 1Munki Facts Jun 17, 2026 Jul 23, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Cross-Site Scripting (XSS) vulnerability in the munki_facts (aka Munki Conditions) module before 1.5 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the key name.
CVE-2020-15902 1Nagios 1Nagios Xi Jun 17, 2026 Jul 22, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option.
CVE-2020-9665 1Magento 1Magento Jun 17, 2026 Jul 22, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2020-15895 1Dlink 1Dir 816l Firmware Jun 17, 2026 Jul 22, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no output filtration is applied to the RESULT parameter, before it's printed on the webpage.
CVE-2020-6535 4Debian FedoraprojectGoogle+1 more 5Backports Sle ChromeDebian Linux+2 more Jun 17, 2026 Jul 22, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient data validation in WebUI in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had compromised the renderer process to inject scripts or HTML into a privileged page via a crafted HTML page.

Previous 1...172417251726...2426 Next