Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,522)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-14012 1Enhancesoft 1Osticket Jun 17, 2026 Jun 10, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 scp/categories.php in osTicket 1.14.2 allows XSS via a Knowledgebase Category Name or Category Description. The attacker must be an Agent.
CVE-2020-14010 1Laborator 1Xenon Jun 17, 2026 Jun 10, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter.
CVE-2020-13271 1Gitlab 1Gitlab Jun 17, 2026 Jun 10, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 13.0.1
CVE-2020-13269 1Gitlab 1Gitlab Jun 17, 2026 Jun 10, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and later through 13.0.1
CVE-2020-13267 1Gitlab 1Gitlab Jun 17, 2026 Jun 10, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1
CVE-2020-6246 1Sap 1Netweaver As Abap Business Server Pages Jun 17, 2026 Jun 10, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_TABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in reflected Cros...Show more SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_TABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.Show less
CVE-2020-1340 1Microsoft 1Nugetgallery Jun 17, 2026 Jun 9, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A spoofing vulnerability exists when the NuGetGallery does not properly sanitize input on package metadata values, aka 'NuGetGallery Spoofing Vulnerability'.
CVE-2020-1327 1Microsoft 1Azure Devops Server Jun 17, 2026 Jun 9, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTML Injection Vulnerability'.
CVE-2020-1320 1Microsoft 3Sharepoint Enterprise Server Sharepoint FoundationSharepoint Server Jun 17, 2026 Jun 9, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnera...Show more A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1177, CVE-2020-1183, CVE-2020-1297, CVE-2020-1298, CVE-2020-1318.Show less
CVE-2020-1318 1Microsoft 3Sharepoint Enterprise Server Sharepoint FoundationSharepoint Server Jun 17, 2026 Jun 9, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnera...Show more A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1177, CVE-2020-1183, CVE-2020-1297, CVE-2020-1298, CVE-2020-1320.Show less
CVE-2020-1298 1Microsoft 3Sharepoint Enterprise Server Sharepoint FoundationSharepoint Server Jun 17, 2026 Jun 9, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnera...Show more A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1177, CVE-2020-1183, CVE-2020-1297, CVE-2020-1318, CVE-2020-1320.Show less
CVE-2020-1297 1Microsoft 3Sharepoint Enterprise Server Sharepoint FoundationSharepoint Server Jun 17, 2026 Jun 9, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnera...Show more A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1177, CVE-2020-1183, CVE-2020-1298, CVE-2020-1318, CVE-2020-1320.Show less
CVE-2020-1289 1Microsoft 1Sharepoint Foundation Jun 17, 2026 Jun 9, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID...Show more A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2020-1148.Show less
CVE-2020-1183 1Microsoft 3Sharepoint Enterprise Server Sharepoint FoundationSharepoint Server Jun 17, 2026 Jun 9, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnera...Show more A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1177, CVE-2020-1297, CVE-2020-1298, CVE-2020-1318, CVE-2020-1320.Show less
CVE-2020-1177 1Microsoft 3Sharepoint Enterprise Server Sharepoint FoundationSharepoint Server Jun 17, 2026 Jun 9, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnera...Show more A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1183, CVE-2020-1297, CVE-2020-1298, CVE-2020-1318, CVE-2020-1320.Show less
CVE-2020-1148 1Microsoft 2Sharepoint Enterprise Server Sharepoint Server Jun 17, 2026 Jun 9, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID...Show more A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2020-1289.Show less
CVE-2020-13911 1Your Online Shop Project 1Your Online Shop Jun 17, 2026 Jun 9, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Your Online Shop 1.8.0 allows authenticated users to trigger XSS via a Change Name or Change Surname operation.
CVE-2020-13892 1Themeboy 1Sportspress Jun 17, 2026 Jun 9, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The SportsPress plugin before 2.7.2 for WordPress allows XSS.
CVE-2020-9843 1Apple 7Icloud IpadosIphone Os+4 more Jun 17, 2026 Jun 9, 2020 N/A· v4 7.1 HIGH· v3 5.8 MEDIUM· v2 An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCl...Show more An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to a cross site scripting attack.Show less
CVE-2020-9805 1Apple 7Icloud IpadosIphone Os+4 more Jun 17, 2026 Jun 9, 2020 N/A· v4 7.1 HIGH· v3 5.8 MEDIUM· v2 A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows...Show more A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to universal cross site scripting.Show less

Previous 1...173717381739...2427 Next