Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,541)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-21167 1Netgear 21D6100 Firmware Dm200 FirmwareEx2700 Firmware+18 more Nov 21, 2024 Apr 27, 2020 N/A· v4 5.5 MEDIUM· v3 3.5 LOW· v2 Certain NETGEAR devices are affected by stored XSS. This affects D6100 before 1.0.0.57, DM200 before 1.0.0.50, EX2700 before 1.0.1.32, EX6100v2 before 1.0.1.70, EX6150v2 before 1.0.1.70, EX6200v2 before 1.0.1.62, EX6400...Show more Certain NETGEAR devices are affected by stored XSS. This affects D6100 before 1.0.0.57, DM200 before 1.0.0.50, EX2700 before 1.0.1.32, EX6100v2 before 1.0.1.70, EX6150v2 before 1.0.1.70, EX6200v2 before 1.0.1.62, EX6400 before 1.0.1.78, EX7300 before 1.0.1.78, EX8000 before 1.0.0.114, R6100 before 1.0.1.22, R7500 before 1.0.0.122, R7800 before 1.0.2.42, R8900 before 1.0.3.10, R9000 before 1.0.3.10, WN2000RPTv3 before 1.0.1.26, WN3000RPv3 before 1.0.2.66, WN3100RPv2 before 1.0.0.42, WNDR3700v4 before 1.0.2.96, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.54, WNDR4500v3 before 1.0.0.54, and WNR2000v5 before 1.0.0.64.Show less
CVE-2018-21155 1Netgear 10D7800 Firmware Dm200 FirmwareR6100 Firmware+7 more Nov 21, 2024 Apr 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.34, DM200 before 1.0.0.52, R6100 before 1.0.1.22, R7500 before 1.0.0.122, R7500v2 before 1.0.3.26, R7800 before 1.0.2.42, R8900 before 1...Show more Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.34, DM200 before 1.0.0.52, R6100 before 1.0.1.22, R7500 before 1.0.0.122, R7500v2 before 1.0.3.26, R7800 before 1.0.2.42, R8900 before 1.0.4.2, R9000 before 1.0.3.16, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.54, WNDR4500v3 before 1.0.0.54, and WNR2000v5 before 1.0.0.64.Show less
CVE-2018-21095 1Netgear 2Srr60 Firmware Srs60 Firmware Nov 21, 2024 Apr 27, 2020 N/A· v4 4.3 MEDIUM· v3 2.3 LOW· v2 Certain NETGEAR devices are affected by stored XSS. This affects SRR60 before 2.2.1.210 and SRS60 before 2.2.1.210.
CVE-2020-11822 1Rukovoditel 1Rukovoditel Jun 17, 2026 Apr 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the application structure --> user access groups page. Thus, an attacker can inject malicious script to steal all users' valuable data.
CVE-2020-12052 1Grafana 1Grafana Jun 17, 2026 Apr 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Grafana version < 6.7.3 is vulnerable for annotation popup XSS.
CVE-2019-18223 1Eleveo 1Call Recording Jun 17, 2026 Apr 27, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 ZOOM International Call Recording 6.3.1 suffers from multiple authenticated stored XSS vulnerabilities via the phoneNumber field in the (1) User Edit or (2) User Add form, (3) name field in the Role Add form, (4) name or...Show more ZOOM International Call Recording 6.3.1 suffers from multiple authenticated stored XSS vulnerabilities via the phoneNumber field in the (1) User Edit or (2) User Add form, (3) name field in the Role Add form, (4) name or number field in the Edit Group form, (5) tagKey or tagValue field in the Recording Rules Configuration, or (6) txt_69735:/VemailAddress/value or txt_75767:/VemailFrom/value field in callrec/config.Show less
CVE-2019-20789 1Croogo 1Croogo Jun 17, 2026 Apr 26, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Croogo before 3.0.7 allows XSS via the title to admin/menus/menus or admin/taxonomy/vocabularies.
CVE-2020-6213 1Sap 1Netweaver As Abap Business Server Pages Jun 17, 2026 Apr 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_PHTMLB, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, is vulnerable to reflected Cross-Site Scripting (XSS) via different URL paramet...Show more SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_PHTMLB, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, is vulnerable to reflected Cross-Site Scripting (XSS) via different URL parameters as it does not sufficiently encode user controlled inputs.Show less
CVE-2020-12245 1Grafana 1Grafana Jun 17, 2026 Apr 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.
CVE-2017-18701 1Netgear 2R6700 Firmware R6900 Firmware Nov 21, 2024 Apr 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Certain NETGEAR devices are affected by reflected XSS. This affects R6700 before 1.0.1.36 and R6900 before 1.0.1.34.
CVE-2017-18700 1Netgear 23D6400 Firmware D7000 FirmwareD8500 Firmware+20 more Nov 21, 2024 Apr 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Certain NETGEAR devices are affected by stored XSS. This affects D6400 before 1.0.0.60, D7000 before 1.0.1.50, D8500 before 1.0.3.29, EX6200 before 1.0.3.84, EX7000 before 1.0.0.60, R6250 before 1.0.4.16, R6300v2 before...Show more Certain NETGEAR devices are affected by stored XSS. This affects D6400 before 1.0.0.60, D7000 before 1.0.1.50, D8500 before 1.0.3.29, EX6200 before 1.0.3.84, EX7000 before 1.0.0.60, R6250 before 1.0.4.16, R6300v2 before 1.0.4.18, R6400 before 1.01.32, R6400v2 before 1.0.2.44, R6700 before 1.0.1.36, R6900 before 1.0.1.34, R6900P before 1.3.0.8, R7000 before 1.0.9.14, R7000P before 1.3.0.8, R7100LG before 1.0.0.34, R7300DST before 1.0.0.56, R7900 before 1.0.1.26, R8000 before 1.0.4.4, R8300 before 1.0.2.106, R8500 before 1.0.2.106, R9000 before 1.0.2.52, WNDR3400v3 before 1.0.1.16, WNR3500Lv2 before 1.2.0.46, and WNDR3700v5 before 1.1.0.48.Show less
CVE-2017-18715 1Netgear 7Ex3700 Firmware Ex3800 FirmwareEx6100 Firmware+4 more Nov 21, 2024 Apr 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Certain NETGEAR devices are affected by reflected XSS. This affects EX3700 before 1.0.0.66, EX3800 before 1.0.0.66, EX6100 before 1.0.2.20, EX6120 before 1.0.0.34, EX6150 before 1.0.0.36, EX6200 before 1.0.3.84, and EX70...Show more Certain NETGEAR devices are affected by reflected XSS. This affects EX3700 before 1.0.0.66, EX3800 before 1.0.0.66, EX6100 before 1.0.2.20, EX6120 before 1.0.0.34, EX6150 before 1.0.0.36, EX6200 before 1.0.3.84, and EX7000 before 1.0.0.60.Show less
CVE-2020-12137 5Canonical DebianFedoraproject+2 more 6Backports Sle Debian LinuxFedora+3 more Jun 17, 2026 Apr 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web...Show more GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.Show less
CVE-2020-12132 1Fifthplay 1S.a.m.i Jun 17, 2026 Apr 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Fifthplay S.A.M.I before 2019.3_HP2 allows unauthenticated stored XSS via a POST request.
CVE-2020-12131 1App2pro 1Airdisk Pro Jun 17, 2026 Apr 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The AirDisk Pro app 5.5.3 for iOS allows XSS via the devicename parameter (shown next to the UI logo).
CVE-2020-12130 1App2pro 1Airdisk Pro Jun 17, 2026 Apr 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function.
CVE-2020-12129 1App2pro 1Airdisk Pro Jun 17, 2026 Apr 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The AirDisk Pro app 5.5.3 for iOS allows XSS via the createFolder parameter of the Create Folder function.
CVE-2020-7132 1Hp 1Onboard Administrator Jun 17, 2026 Apr 23, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A potential security vulnerability has been identified in HPE Onboard Administrator. The vulnerability could be remotely exploited to allow Reflected Cross Site Scripting. HPE has made the following software updates and...Show more A potential security vulnerability has been identified in HPE Onboard Administrator. The vulnerability could be remotely exploited to allow Reflected Cross Site Scripting. HPE has made the following software updates and mitigation information to resolve the vulnerability in HPE Onboard Administrator. * OA 4.95 (Linux and Windows).Show less
CVE-2020-12113 1Bigbluebutton 1Bigbluebutton Jun 17, 2026 Apr 23, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used.
CVE-2017-18745 1Netgear 9R6400 Firmware R6700 FirmwareR6900 Firmware+6 more Nov 21, 2024 Apr 23, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Certain NETGEAR devices are affected by stored XSS. This affects R6400 before 1.0.1.14, R6700 before 1.0.1.22, R6900 before 1.0.1.22, R7000 before 1.0.9.4, R7100LG before 1.0.0.32, R7300DST before 1.0.0.56, R7900 before...Show more Certain NETGEAR devices are affected by stored XSS. This affects R6400 before 1.0.1.14, R6700 before 1.0.1.22, R6900 before 1.0.1.22, R7000 before 1.0.9.4, R7100LG before 1.0.0.32, R7300DST before 1.0.0.56, R7900 before 1.0.1.12, R8000 before 1.0.3.24, and R8500 before 1.0.2.74.Show less

Previous 1...174817491750...2428 Next