Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (46,279)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-5457 1Min Http Server Project 1Min Http Server Jun 17, 2026 Jul 30, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser.
CVE-2019-5450 1Nextcloud 1Nextcloud Jun 17, 2026 Jul 30, 2019 N/A· v4 6.8 MEDIUM· v3 4.6 MEDIUM· v2 Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in the header bar when using basic HTML.
CVE-2018-20859 1Edx 1Edx Platform Nov 21, 2024 Jul 30, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.
CVE-2019-14406 1Cpanel 1Cpanel Jun 17, 2026 Jul 30, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).
CVE-2018-20868 1Cpanel 1Cpanel Nov 21, 2024 Jul 30, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).
CVE-2018-20866 1Cpanel 1Cpanel Nov 21, 2024 Jul 30, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).
CVE-2018-20865 1Cpanel 1Cpanel Nov 21, 2024 Jul 30, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).
CVE-2019-14390 1Cpanel 1Cpanel Jun 17, 2026 Jul 30, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).
CVE-2019-14387 1Cpanel 1Cpanel Jun 17, 2026 Jul 30, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).
CVE-2019-14386 1Cpanel 1Cpanel Jun 17, 2026 Jul 30, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).
CVE-2018-18570 1Planonsoftware 1Planon Nov 21, 2024 Jul 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Planon before Live Build 41 has XSS.
CVE-2019-14415 1Veritas 1Resiliency Platform Jun 17, 2026 Jul 29, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. A persistent cross-site scripting (XSS) vulnerability allows a malicious VRP user to inject malicious script into another user's browser, relat...Show more An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. A persistent cross-site scripting (XSS) vulnerability allows a malicious VRP user to inject malicious script into another user's browser, related to resiliency plans functionality. A victim must open a resiliency plan that an attacker has access to.Show less
CVE-2019-11199 1Dolibarr 1Dolibarr Erp/crm Jun 17, 2026 Jul 29, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link...Show more Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low privileged users to target administrators. The viewimage.php page did not perform any contextual output encoding and would display the content within the uploaded file with a user-requested MIME type.Show less
CVE-2015-6960 1Edx 1Edx Platform Nov 21, 2024 Jul 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 edx-platform before 2015-09-17 allows XSS via a team name.
CVE-2015-6253 1Edx 1Edx Platform Nov 21, 2024 Jul 29, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.
CVE-2019-1020008 1Stacktable.js Project 1Stacktable.js Jun 17, 2026 Jul 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 stacktable.js before 1.0.4 allows XSS.
CVE-2019-1020007 1Owasp 1Dependency Track Jun 17, 2026 Jul 29, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Dependency-Track before 3.5.1 allows XSS.
CVE-2019-1020005 1Inveniosoftware 1Invenio Communities Jun 17, 2026 Jul 29, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 invenio-communities before 1.0.0a20 allows XSS.
CVE-2019-1020003 1Inveniosoftware 1Invenio Records Jun 17, 2026 Jul 29, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 invenio-records before 1.2.2 allows XSS.
CVE-2019-1105 1Microsoft 1Outlook Jun 17, 2026 Jul 29, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email...Show more A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted email message to a victim. The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on the affected systems and run scripts in the security context of the current user. The security update addresses the vulnerability by correcting how Outlook for Android parses specially crafted email messages.Show less

Previous 1...174417451746...2314 Next