Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,518)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-20416 1Atlassian 2Jira Jira Software Data Center Jun 17, 2026 Jun 30, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the project configuration feature. The affected v...Show more Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the project configuration feature. The affected versions are before version 8.3.0.Show less
CVE-2020-14413 1Nedi 1Nedi Jun 17, 2026 Jun 29, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demons...Show more NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a Devices-Config.php?sta= value.Show less
CVE-2020-14071 1Mk Auth 1Mk Auth Jun 17, 2026 Jun 29, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code.
CVE-2020-4557 1Ibm 2Business Automation Workflow Business Process Manager Jun 17, 2026 Jun 29, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI...Show more IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183611.Show less
CVE-2020-13423 1Form Builder For Magento 2 Project 1Form Builder For Magento 2 Jun 17, 2026 Jun 29, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Form Builder 2.1.0 for Magento has multiple XSS issues that can be exploited against Magento 2 admin accounts via the Current_url or email field, or the User-Agent HTTP header.
CVE-2020-12635 1Mageme 1Webforms Pro M2 Jun 17, 2026 Jun 29, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in the WebForms Pro M2 extension before 2.9.17 for Magento 2 via the textarea field.
CVE-2019-20414 1Atlassian 4Jira Jira Data CenterJira Server+1 more Jun 17, 2026 Jun 29, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in Issue Navigator Basic Search. The affected versio...Show more Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in Issue Navigator Basic Search. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.Show less
CVE-2020-15364 1Nexos Project 1Nexos Jun 17, 2026 Jun 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.
CVE-2020-9584 1Magento 1Magento Jun 17, 2026 Jun 26, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive informati...Show more Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.Show less
CVE-2020-9581 1Magento 1Magento Jun 17, 2026 Jun 26, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive informati...Show more Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.Show less
CVE-2020-9577 1Magento 1Magento Jun 17, 2026 Jun 26, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive informati...Show more Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure .Show less
CVE-2020-4223 1Ibm 1Maximo Asset Management Jun 17, 2026 Jun 26, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentiall...Show more IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 175121.Show less
CVE-2020-15017 1Nedi 1Nedi Jun 17, 2026 Jun 26, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the sta GET parameter...Show more NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the sta GET parameter.Show less
CVE-2020-15016 1Nedi 1Nedi Jun 17, 2026 Jun 26, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 NeDi 1.9C is vulnerable to reflected cross-site scripting. The Other-Converter.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the txt GET paramete...Show more NeDi 1.9C is vulnerable to reflected cross-site scripting. The Other-Converter.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the txt GET parameter.Show less
CVE-2020-9437 1Secureauth 1Secureauth Identity Provider Jun 17, 2026 Jun 25, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 SecureAuth.aspx in SecureAuth IdP 9.3.0 suffers from a client-side template injection that allows for script execution, in the same manner as XSS.
CVE-2020-7355 1Rapid7 1Metasploit Jun 17, 2026 Jun 25, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site Scripting (XSS) vulnerability in the 'notes' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target store an XSS sequence in the...Show more Cross-site Scripting (XSS) vulnerability in the 'notes' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target store an XSS sequence in the Metasploit Pro console, which will trigger when the operator views the record of that scanned host in the Metasploit Pro interface. This issue affects Rapid7 Metasploit Pro version 4.17.1-20200427 and prior versions, and is fixed in Metasploit Pro version 4.17.1-20200514. See also CVE-2020-7354, which describes a similar issue, but involving the generated 'host' field of a discovered scan asset.Show less
CVE-2020-7354 1Rapid7 1Metasploit Jun 17, 2026 Jun 25, 2020 N/A· v4 5.4 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site Scripting (XSS) vulnerability in the 'host' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target to store an XSS sequence in th...Show more Cross-site Scripting (XSS) vulnerability in the 'host' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target to store an XSS sequence in the Metasploit Pro console, which will trigger when the operator views the record of that scanned host in the Metasploit Pro interface. This issue affects Rapid7 Metasploit Pro version 4.17.1-20200427 and prior versions, and is fixed in Metasploit Pro version 4.17.1-20200514. See also CVE-2020-7355, which describes a similar issue, but involving the generated 'notes' field of a discovered scan asset.Show less
CVE-2020-15041 1Php Fusion 1Php Fusion Jun 17, 2026 Jun 24, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 PHP-Fusion 9.03.60 allows XSS via the administration/site_links.php Add Site Link field.
CVE-2020-15038 1Seedprod 1Coming Soon Page, Under Construction & Maintenance Mode Jun 17, 2026 Jun 24, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS.
CVE-2020-13248 1Boolebox 1Boolebox Jun 17, 2026 Jun 24, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 BooleBox Secure File Sharing Utility before 4.2.3.0 allows stored XSS via a crafted avatar field within My Account JSON data to Account.aspx.

Previous 1...173217331734...2426 Next