← Back
CWE-79

48,522 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,522)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-18624
1Grafana
1Grafana
Nov 21, 2024
Jun 2, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
CVE-2018-18623
1Grafana
1Grafana
Nov 21, 2024
Jun 2, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
CVE-2020-4503
1Ibm
1Planning Analytics Local
Jun 17, 2026
Jun 2, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cre...Show more
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182283.Show less
CVE-2020-4431
1Ibm
1Planning Analytics Local
Jun 17, 2026
Jun 2, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cre...Show more
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 180761.Show less
CVE-2020-4366
1Ibm
1Planning Analytics Local
Jun 17, 2026
Jun 2, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cre...Show more
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178965.Show less
CVE-2020-4360
1Ibm
1Planning Analytics Local
Jun 17, 2026
Jun 2, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cre...Show more
IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178765.Show less
CVE-2020-13228
1Sysax
1Multi Server
Jun 17, 2026
Jun 2, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Sysax Multi Server 6.90. There is reflected XSS via the /scgi sid parameter.
CVE-2020-13758
1Bitrix
1Bitrix24
Jun 17, 2026
Jun 1, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
modules/security/classes/general.post_filter.php/post_filter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by placing %00 before the payload.
CVE-2014-8944
1Piwigo
1Lexiglot
Nov 21, 2024
Jun 1, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Lexiglot through 2014-11-20 allows XSS (Reflected) via the username, or XSS (Stored) via the admin.php?page=config install_name, intro_message, or new_file_content parameter.
CVE-2020-4023
1Atlassian
2Crucible
Fisheye
Jun 17, 2026
Jun 1, 2020
N/A· v4
5.4 MEDIUM· v3
4.3 MEDIUM· v2
The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the committerFilte...Show more
The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the committerFilter parameter.Show less
CVE-2020-4021
1Atlassian
4Jira
Jira Data CenterJira Server+1 more
Jun 17, 2026
Jun 1, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in th...Show more
Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the XML export view.Show less
CVE-2020-4013
1Atlassian
2Crucible
Fisheye
Jun 17, 2026
Jun 1, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the review objectives.
CVE-2020-4306
1Ibm
1Planning Analytics Local
Jun 17, 2026
May 29, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Planning Analytics Local 2.0.0 through 2.0.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentiall...Show more
IBM Planning Analytics Local 2.0.0 through 2.0.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 176735.Show less
CVE-2020-11082
2Debian
Kaminari Project
2Debian Linux
Kaminari
Jun 17, 2026
May 28, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.
CVE-2020-13660
1Cmsmadesimple
1Cms Made Simple
Jun 17, 2026
May 28, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
CVE-2020-4419
1Ibm
1Jazz Reporting Service
Jun 17, 2026
May 28, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentia...Show more
IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 180071.Show less
CVE-2020-13644
1Pickplugins
1Accordion
Jun 17, 2026
May 28, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability...Show more
An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordion.Show less
CVE-2020-8603
1Trendmicro
1Interscan Web Security Virtual Appliance
Jun 17, 2026
May 27, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A cross-site scripting vulnerability (XSS) in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remote attacker to tamper with the web interface of affected installations. User interaction is required...Show more
A cross-site scripting vulnerability (XSS) in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remote attacker to tamper with the web interface of affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.Show less
CVE-2020-13633
1Fork Cms
1Fork Cms
Jun 17, 2026
May 27, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Fork before 5.8.3 allows XSS via navigation_title or title.
CVE-2020-13628
1Centreon
3Centreon Host Monitoring Widget
Centreon Service Monitoring WidgetCentreon Tactical Overview Widget
Jun 17, 2026
May 27, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-monitoring/src/toolbar.php. This vulnerability is fixed in versions 1.6.4, 18.10....Show more
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-monitoring/src/toolbar.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.Show less