← Back
CWE-79

48,551 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,551)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-17231
1Mageewp
1Onetone
Jun 17, 2026
Apr 3, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.
CVE-2020-5283
1Viewvc
1Viewvc
Jun 17, 2026
Apr 3, 2020
N/A· v4
3.5 LOW· v3
2.1 LOW· v2
ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository...Show more
ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository exposed by an otherwise trusted ViewVC instance that also has the `show_subdir_lastmod` feature enabled. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. This vulnerability is patched in versions 1.2.1 and 1.1.28.Show less
CVE-2020-11499
1Firmware Analysis And Comparison Tool Project
1Firmware Analysis And Comparison Tool
Jun 17, 2026
Apr 2, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Firmware Analysis and Comparison Tool (FACT) 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by mishandling of the tags and version fields in helperFunctions/mongo_task_conver...Show more
Firmware Analysis and Comparison Tool (FACT) 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by mishandling of the tags and version fields in helperFunctions/mongo_task_conversion.py.Show less
CVE-2019-19095
1Hitachienergy
1Esoms
Jun 17, 2026
Apr 2, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Lack of adequate input/output validation for ABB eSOMS versions 4.0 to 6.0.2 might allow an attacker to attack such as stored cross-site scripting by storing malicious content in the database.
CVE-2019-19003
1Hitachienergy
1Esoms
Jun 17, 2026
Apr 2, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
For ABB eSOMS versions 4.0 to 6.0.2, the HTTPOnly flag is not set. This can allow Javascript to access the cookie contents, which in turn might enable Cross Site Scripting.
CVE-2019-19002
1Hitachienergy
1Esoms
Jun 17, 2026
Apr 2, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HTTP response header is not set in responses from the web server. For older web browser not supporting Content Security Policy, this might increase the risk of Cr...Show more
For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HTTP response header is not set in responses from the web server. For older web browser not supporting Content Security Policy, this might increase the risk of Cross Site Scripting.Show less
CVE-2020-4304
1Ibm
1Websphere Application Server
Jun 17, 2026
Apr 2, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended func...Show more
IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 176670.Show less
CVE-2020-4303
1Ibm
1Websphere Application Server
Jun 17, 2026
Apr 2, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended func...Show more
IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 176668.Show less
CVE-2020-11454
1Microstrategy
1Microstrategy Web
Jun 17, 2026
Apr 2, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowing for the creation of a new dashboard. In order to exploit this vulnerability, a user needs to get a...Show more
Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowing for the creation of a new dashboard. In order to exploit this vulnerability, a user needs to get access to a shared dashboard or have the ability to create a dashboard on the application.Show less
CVE-2020-8966
1Tiki
1Tikiwiki Cms/groupware
Jun 17, 2026
Apr 1, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware. Tiki-Wiki CMS all versions through 20.0 allows malicious users to cause the...Show more
There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware. Tiki-Wiki CMS all versions through 20.0 allows malicious users to cause the injection of malicious code fragments (scripts) into a legitimate web page.Show less
CVE-2020-1949
1Apache
1Sling Cms
Jun 17, 2026
Apr 1, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the administrative consoles and are vulnerable to reflected XSS attacks.
CVE-2020-1943
1Apache
1Ofbiz
Jun 17, 2026
Apr 1, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.
CVE-2020-10203
1Sonatype
1Nexus
Jun 17, 2026
Apr 1, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Sonatype Nexus Repository before 3.21.2 allows XSS.
CVE-2020-3902
1Apple
6Icloud
Ipad OsIphone Os+3 more
Jun 17, 2026
Apr 1, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7...Show more
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. Processing maliciously crafted web content may lead to a cross site scripting attack.Show less
CVE-2020-11457
1Netgate
1Pfsense
Jun 17, 2026
Apr 1, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user.
CVE-2020-11456
1Limesurvey
1Limesurvey
Jun 17, 2026
Apr 1, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups).
CVE-2020-6753
1Auth0
1Login By Auth0
Jun 17, 2026
Apr 1, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392.
CVE-2020-5392
1Auth0
1Wp Auth0
Jun 17, 2026
Apr 1, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page.
CVE-2019-13495
1Zyxel
1Xgs2210 52hp Firmware
Jun 17, 2026
Mar 31, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
In firmware version 4.50 of Zyxel XGS2210-52HP, multiple stored cross-site scripting (XSS) issues allows remote authenticated users to inject arbitrary web script via an rpSys.html Name or Location field.
CVE-2019-10180
2Dogtagpki
Redhat
2Certificate System
Dogtagpki
Jun 17, 2026
Mar 31, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (...Show more
A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (XSS) vulnerability. An attacker able to modify the parameters of any token could use this flaw to trick an authenticated user into executing arbitrary JavaScript code.Show less