Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,533)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-2017 1Paloaltonetworks 1Pan Os Jun 17, 2026 May 13, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A DOM-Based Cross Site Scripting Vulnerability exists in PAN-OS and Panorama Management Web Interfaces. A remote attacker able to convince an authenticated administrator to click on a crafted link to PAN-OS and Panorama...Show more A DOM-Based Cross Site Scripting Vulnerability exists in PAN-OS and Panorama Management Web Interfaces. A remote attacker able to convince an authenticated administrator to click on a crafted link to PAN-OS and Panorama Web Interfaces could execute arbitrary JavaScript code in the administrator's browser and perform administrative actions. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; All versions of PAN-OS 8.0.Show less
CVE-2020-2005 1Paloaltonetworks 1Pan Os Jun 17, 2026 May 13, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN that can compromise the user's active session. This issue affects: PAN-OS 7.1 ve...Show more A cross-site scripting (XSS) vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN that can compromise the user's active session. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7; All versions of PAN-OS 8.0.Show less
CVE-2020-11070 1Typo3 1Svg Sanitizer Jun 17, 2026 May 13, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3. Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the mark...Show more The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3. Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site scripting. This is fixed in version 1.0.3.Show less
CVE-2020-5838 1Symantec 1It Analytics Jun 17, 2026 May 13, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Symantec IT Analytics, prior to 2.9.1, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can potentially enable attackers to inject client-side scripts into web pages viewed by oth...Show more Symantec IT Analytics, prior to 2.9.1, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can potentially enable attackers to inject client-side scripts into web pages viewed by other users.Show less
CVE-2020-8020 2Debian Opensuse 2Debian Linux Open Build Service Jun 17, 2026 May 13, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause XSS. This issue affects: openSUSE open-build-service versions...Show more A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause XSS. This issue affects: openSUSE open-build-service versions prior to 7cc32c8e2ff7290698e101d9a80a9dc29a5500fb.Show less
CVE-2020-11062 1Glpi Project 1Glpi Jun 17, 2026 May 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In GLPI after 0.68.1 and before 9.4.6, multiple reflexive XSS occur in Dropdown endpoints due to an invalid Content-Type. This has been fixed in version 9.4.6.
CVE-2020-6257 1Sap 1Businessobjects Business Intelligence Platform Jun 17, 2026 May 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability.
CVE-2020-6254 1Sap 1Enterprise Threat Detection Jun 17, 2026 May 12, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payload reflecting in the response, leading to reflected Cross Site Scripting.
CVE-2020-8155 1Nextcloud 1Nextcloud Server Jun 17, 2026 May 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF.
CVE-2020-9314 1Oracle 1Iplanet Web Server Jun 17, 2026 May 10, 2020 N/A· v4 4.8 MEDIUM· v3 4.9 MEDIUM· v2 PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomple...Show more PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. NOTE: a related support policy can be found in the www.oracle.com references attached to this CVE.Show less
CVE-2020-11006 1Shopizer 1Shopizer Jun 17, 2026 May 8, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In Shopizer before version 2.11.0, a script can be injected in various forms and saved in the database, then executed when information is fetched from backend. This has been patched in version 2.11.0.
CVE-2020-12718 1Php Fusion 1Php Fusion Jun 17, 2026 May 8, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML even...Show more In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle.Show less
CVE-2020-11055 1Bookstackapp 1Bookstack Jun 17, 2026 May 7, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comm...Show more In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines. This most impacts scenarios where not-trusted users are given permission to create comments. This has been fixed in 0.29.2.Show less
CVE-2020-12708 1Php Fusion 1Php Fusion Jun 17, 2026 May 7, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the cat_id parameter to downloads/downloads.php or article.php. NOTE: this might overl...Show more Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the cat_id parameter to downloads/downloads.php or article.php. NOTE: this might overlap CVE-2012-6043.Show less
CVE-2020-12707 1Lepton Cms 1Lepton Cms Jun 17, 2026 May 7, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT elements. A malicious actor can use HTML eve...Show more An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT elements. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT elements.Show less
CVE-2020-12706 1Php Fusion 1Php Fusion Jun 17, 2026 May 7, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or shoutbox_panel/shoutbox_admin.php
CVE-2020-12705 1Lepton Cms 1Leptoncms Jun 17, 2026 May 7, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities exist in LeptonCMS before 4.6.0.
CVE-2020-12704 1Ulicms 1Ulicms Jun 17, 2026 May 7, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 UliCMS before 2020.2 has PageController stored XSS.
CVE-2020-12703 1Ulicms 1Ulicms Jun 17, 2026 May 7, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 UliCMS before 2020.2 has XSS during PackageController uninstall.
CVE-2020-5751 1Tecnick 1Tcexam Jun 17, 2026 May 7, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating a crafted operator.

Previous 1...174417451746...2427 Next