← Back
CWE-79

48,522 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,522)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-4183
1Ibm
1Security Guardium
Jun 17, 2026
Jun 4, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM Security Guardium 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentia...Show more
IBM Security Guardium 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174739.Show less
CVE-2020-6640
1Fortinet
1Fortianalyzer
Jun 17, 2026
Jun 4, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An improper neutralization of input vulnerability in the Admin Profile of FortiAnalyzer may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Description Area.
CVE-2020-5298
1Octobercms
1October
Jun 17, 2026
Jun 3, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an...Show more
In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Issue has been patched in Build 466 (v1.0.466).Show less
CVE-2020-13798
1Naviwebs
1Navigate Cms
Jun 17, 2026
Jun 3, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/feeds/feed.class.php.
CVE-2020-13797
1Naviwebs
1Navigate Cms
Jun 17, 2026
Jun 3, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/websites/website.class.php.
CVE-2020-13796
1Naviwebs
1Navigate Cms
Jun 17, 2026
Jun 3, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/structure/structure.class.php.
CVE-2020-7015
1Elastic
1Kibana
Jun 17, 2026
Jun 3, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSVB visualization could allow the attacker to obtain sensitive information from, o...Show more
Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSVB visualization could allow the attacker to obtain sensitive information from, or perform destructive actions, on behalf of Kibana users who edit the TSVB visualization.Show less
CVE-2020-7011
1Elastic
1Elastic App Search
Jun 17, 2026
Jun 3, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injects a URL into a result, that URL will be rendered by the web...Show more
Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injects a URL into a result, that URL will be rendered by the web browser. If an attacker is able to control the contents of such a field, they could execute arbitrary JavaScript in the victim�s web browser.Show less
CVE-2020-3233
1Cisco
1Iox
Jun 17, 2026
Jun 3, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A vulnerability in the web-based Local Manager interface of the Cisco IOx Application Framework could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the we...Show more
A vulnerability in the web-based Local Manager interface of the Cisco IOx Application Framework could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based Local Manager interface of an affected device. The attacker must have valid Local Manager credentials. The vulnerability is due to insufficient validation of user-supplied input by the web-based Local Manager interface of the affected software. An attacker could exploit this vulnerability by injecting malicious code into a system settings tab. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web interface or allow the attacker to access sensitive browser-based information.Show less
CVE-2020-4182
1Ibm
1Security Guardium
Jun 17, 2026
Jun 3, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM Security Guardium 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentia...Show more
IBM Security Guardium 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174738.Show less
CVE-2020-13596
6Canonical
DebianDjangoproject+3 more
7Debian Linux
DjangoFedora+4 more
Jun 17, 2026
Jun 3, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
CVE-2020-2199
1Jenkins
1Subversion Partial Release Manager
Jun 17, 2026
Jun 3, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting in a reflected cross-site scripting vulnerability.
CVE-2020-2195
1Jenkins
1Compact Columns
Jun 17, 2026
Jun 3, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Jenkins Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips, resulting in a stored cross-site scripting vulnerability that can be exploited by users with Job/Configure permission.
CVE-2020-2194
1Jenkins
1Echarts Api
Jun 17, 2026
Jun 3, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2193
1Jenkins
1Echarts Api
Jun 17, 2026
Jun 3, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts, resulting in a stored cross-site scripting vulnerability.
CVE-2020-2190
1Jenkins
1Script Security
Jun 17, 2026
Jun 3, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.
CVE-2020-13762
1Joomla
1Joomla
Jun 17, 2026
Jun 2, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In Joomla! before 3.9.19, incorrect input validation of the module tag option in com_modules allows XSS.
CVE-2020-13761
1Joomla
1Joomla
Jun 17, 2026
Jun 2, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS.
CVE-2019-11843
1Automattic
1Mailpoet
Jun 17, 2026
Jun 2, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Server-Side XSS).
CVE-2018-18625
1Grafana
1Grafana
Nov 21, 2024
Jun 2, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.