Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,522)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-8542 1Open Xchange 1Open Xchange Appsuite Jun 17, 2026 Jun 16, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 OX App Suite through 7.10.3 allows XSS.
CVE-2020-11838 1Microfocus 1Arcsight Management Center Jun 17, 2026 Jun 16, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, 2.9.x prior to 2.9.4. The vulnerabilities could be remotely exploited resulting in Cross...Show more Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, 2.9.x prior to 2.9.4. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (XSS) or information disclosure.Show less
CVE-2020-4051 3Debian NetappOpenjsf 6Active Iq Unified Manager Debian LinuxDijit+3 more Jun 17, 2026 Jun 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater...Show more In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.Show less
CVE-2020-13652 1Digdash 1Digdash Jun 17, 2026 Jun 15, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in DigDash 2018R2 before p20200528, 2019R1 before p20200528, 2019R2 before p20200430, and 2020R1 before p20200507. A cross-site scripting (XSS) vulnerability exists in the login menu.
CVE-2020-9426 1Open Xchange 1Ox Guard Jun 17, 2026 Jun 15, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 OX Guard 2.10.3 and earlier allows XSS.
CVE-2020-14146 1Kumbiaphp 1Kumbiaphp Jun 17, 2026 Jun 15, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 KumbiaPHP through 1.1.1, in Development mode, allows XSS via the public/pages/kumbia PATH_INFO.
CVE-2019-19112 1Gvectors 1Wpforo Jun 17, 2026 Jun 15, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php.
CVE-2019-19111 1Gvectors 1Wpforo Jun 17, 2026 Jun 15, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter.
CVE-2019-19110 1Gvectors 1Wpforo Jun 17, 2026 Jun 15, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter.
CVE-2020-11839 1Microfocus 1Arcsight Logger Jun 17, 2026 Jun 12, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Logger product, affecting all version from 6.6.1 up to version 7.0.1. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (XS...Show more Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Logger product, affecting all version from 6.6.1 up to version 7.0.1. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (XSS) or information disclosure.Show less
CVE-2020-4049 3Debian FedoraprojectWordpress 3Debian Linux FedoraWordpress Jun 17, 2026 Jun 12, 2020 N/A· v4 2.4 LOW· v3 3.5 LOW· v2 In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload...Show more In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).Show less
CVE-2020-4046 3Debian FedoraprojectWordpress 3Debian Linux FedoraWordpress Jun 17, 2026 Jun 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a hig...Show more In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).Show less
CVE-2020-9651 1Adobe 1Experience Manager Jun 17, 2026 Jun 12, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (reflected) vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser.
CVE-2020-9648 1Adobe 1Experience Manager Jun 17, 2026 Jun 12, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser.
CVE-2020-9647 1Adobe 1Experience Manager Jun 17, 2026 Jun 12, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (dom-based) vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser.
CVE-2020-9644 1Adobe 1Experience Manager Jun 17, 2026 Jun 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (stored) vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser.
CVE-2020-4251 1Ibm 1Api Connect Jun 17, 2026 Jun 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM API Connect 5.0.0.0 through 5.0.8.8 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...Show more IBM API Connect 5.0.0.0 through 5.0.8.8 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 175489.Show less
CVE-2020-4380 1Ibm 1Workload Scheduler Jun 17, 2026 Jun 11, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Workload Scheduler 9.3.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to crede...Show more IBM Workload Scheduler 9.3.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 179160.Show less
CVE-2020-5592 1Zenphoto 1Zenphoto Jun 17, 2026 Jun 11, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in Zenphoto versions prior to 1.5.7 allows remote attackers to inject an arbitrary JavaScript via unspecified vectors.
CVE-2020-13853 1Pandorafms 1Pandora Fms Jun 17, 2026 Jun 11, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Artica Pandora FMS 7.44 has persistent XSS in the Messages feature.

Previous 1...173617371738...2427 Next