Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,518)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-15015 1Gleamtech 1Fileultimate Jun 17, 2026 Jun 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The FileExplorer component in GleamTech FileUltimate 6.1.5.0 allows XSS via an SVG document.
CVE-2020-14018 1Naviwebs 1Navigate Cms Jun 17, 2026 Jun 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Navigate CMS 2.9 r1433. There is a stored XSS vulnerability that is executed on the page to view users, and on the page to edit users. This is present in both the User field and the E-Mail fiel...Show more An issue was discovered in Navigate CMS 2.9 r1433. There is a stored XSS vulnerability that is executed on the page to view users, and on the page to edit users. This is present in both the User field and the E-Mail field. On the Edit user page, the XSS is only triggered via the E-Mail field; however, on the View user page the XSS is triggered via either the User field or the E-Mail field.Show less
CVE-2020-14014 1Naviwebs 1Navigate Cms Jun 17, 2026 Jun 24, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in Navigate CMS 2.8 and 2.9 r1433. The query parameter fid on the resource navigate.php does not perform sufficient data validation and/or encoding, making it vulnerable to reflected XSS.
CVE-2020-13483 1Bitrix24 1Bitrix24 Jun 17, 2026 Jun 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the items[ITEMS][ID] parameter to the components/bitrix/mobileapp.list/ajax.php/ URI.
CVE-2020-4323 1Ibm 1Security Secret Server Jun 17, 2026 Jun 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cred...Show more IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 177514.Show less
CVE-2020-14007 1Solarwinds 2Orion Network Performance Monitor Orion Web Performance Monitor Jun 17, 2026 Jun 24, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a name of an alert definition.
CVE-2020-14006 1Solarwinds 2Orion Network Performance Monitor Orion Web Performance Monitor Jun 17, 2026 Jun 24, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a Responsible Team.
CVE-2020-15006 1Bludit 1Bludit Jun 17, 2026 Jun 24, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Bludit 3.12.0 allows stored XSS via JavaScript code in an SVG document to bl-kernel/ajax/logo-upload.php.
CVE-2020-12021 1Osisoft 1Pi Web Api Jun 17, 2026 Jun 23, 2020 N/A· v4 9.0 CRITICAL· v3 6.0 MEDIUM· v2 In OSIsoft PI Web API 2019 Patch 1 (1.12.0.6346) and all previous versions, the affected product is vulnerable to a cross-site scripting attack, which may allow an attacker to remotely execute arbitrary code.
CVE-2020-14073 1Paessler 1Prtg Network Monitor Jun 17, 2026 Jun 23, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 XSS exists in PRTG Network Monitor 20.1.56.1574 via crafted map properties. An attacker with Read/Write privileges can create a map, and then use the Map Designer Properties screen to insert JavaScript code. This can be...Show more XSS exists in PRTG Network Monitor 20.1.56.1574 via crafted map properties. An attacker with Read/Write privileges can create a map, and then use the Map Designer Properties screen to insert JavaScript code. This can be exploited against any user with View Maps or Edit Maps access.Show less
CVE-2020-14965 1Tp Link 2Tl Wr740n Firmware Tl Wr740nd Firmware Jun 17, 2026 Jun 23, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attacker with access to the admin panel can inject HTML code and change the HTML context of the target pages and stations in the access-control settings via targets_l...Show more On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attacker with access to the admin panel can inject HTML code and change the HTML context of the target pages and stations in the access-control settings via targets_lists_name or hosts_lists_name. The vulnerability can also be exploited through a CSRF, requiring no authentication as an administrator.Show less
CVE-2020-14943 1Globalradar 1Bsa Radar Jun 17, 2026 Jun 22, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting (XSS) via Update User Profile.
CVE-2019-3865 1Redhat 1Quay Jun 17, 2026 Jun 22, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name field of service key to inject scripts and make it run when admi...Show more A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name field of service key to inject scripts and make it run when admin users try to change the name.Show less
CVE-2020-14973 1Webtareas Project 1Webtareas Jun 17, 2026 Jun 22, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting (XSS) vulnerability via the query string.
CVE-2020-13480 1Verint 1Workforce Optimization Jun 17, 2026 Jun 22, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Verint Workforce Optimization (WFO) 15.2 allows HTML injection via the "send email" feature.
CVE-2020-13427 1Victorcms Project 1Victorcms Jun 17, 2026 Jun 22, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Victor CMS 1.0 has Persistent XSS in admin/users.php?source=add_user via the user_name, user_firstname, or user_lastname parameter.
CVE-2020-9288 1Fortinet 1Fortiwlc Jun 17, 2026 Jun 22, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An improper neutralization of input vulnerability in FortiWLC 8.5.1 allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the ESS profile or the Radius Profile.
CVE-2020-4070 1W3c 1Css Validator Jun 17, 2026 Jun 22, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs. A user would have to click on a specifically crafted validator link to trigger it. This has been patc...Show more In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs. A user would have to click on a specifically crafted validator link to trigger it. This has been patched in commit e5c09a9.Show less
CVE-2020-13888 1Kordil Edms Project 1Kordil Edms Jun 17, 2026 Jun 22, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Kordil EDMS through 2.2.60rc3 allows stored XSS in users_edit.php, users_management_edit.php, and user_management.php.
CVE-2020-14202 1Ibi 1Webfocus Business Intelligence Jun 17, 2026 Jun 22, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 WebFOCUS Business Intelligence 8.0 (SP6) was prone to XSS via arbitrary URL parameters.

Previous 1...173317341735...2426 Next