Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,551)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-10790 1It Novum 1Openitcockpit Jun 17, 2026 Mar 25, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to XSS.
CVE-2020-5559 1Wl Enq Project 1Wl Enq Jun 17, 2026 Mar 25, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in WL-Enq 1.11 and 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2020-5557 1Cutephp 1Cutenews Jun 17, 2026 Mar 25, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in CuteNews 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2020-5552 1Mailform 1Mailform Jun 17, 2026 Mar 25, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in mailform version 1.04 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2020-6816 2Fedoraproject Mozilla 2Bleach Fedora Jun 17, 2026 Mar 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.
CVE-2020-6802 2Fedoraproject Mozilla 2Bleach Fedora Jun 17, 2026 Mar 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.
CVE-2020-8985 1Zend 1Zendto Jun 17, 2026 Mar 24, 2020 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality.
CVE-2019-17276 1Netapp 1Oncommand System Manager Jun 17, 2026 Mar 24, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 OnCommand System Manager versions 9.3 prior to 9.3P18 and 9.4 prior to 9.4P2 are susceptible to a cross site scripting vulnerability that could allow an authenticated attacker to inject arbitrary scripts into the SNMP Co...Show more OnCommand System Manager versions 9.3 prior to 9.3P18 and 9.4 prior to 9.4P2 are susceptible to a cross site scripting vulnerability that could allow an authenticated attacker to inject arbitrary scripts into the SNMP Community Names label field.Show less
CVE-2020-10385 1Wpforms 1Contact Form Jun 17, 2026 Mar 24, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.
CVE-2019-4681 1Ibm 1Tivoli Netcool/impact Jun 17, 2026 Mar 24, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentia...Show more IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 171734.Show less
CVE-2020-7482 1Schneider Electric 11Andover Continuum 5720 Firmware Andover Continuum 5740 FirmwareAndover Continuum 9200 Firmware+8 more Jun 17, 2026 Mar 23, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists Andover Continuum (All versions), which could cause a Reflective Cross-site Scripting (XSS attack) when u...Show more A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists Andover Continuum (All versions), which could cause a Reflective Cross-site Scripting (XSS attack) when using the products' web server.Show less
CVE-2020-7481 1Schneider Electric 11Andover Continuum 5720 Firmware Andover Continuum 5740 FirmwareAndover Continuum 9200 Firmware+8 more Jun 17, 2026 Mar 23, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists Andover Continuum (All versions), which could enable a successful Cross-site Scripting (XSS attack) when...Show more A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists Andover Continuum (All versions), which could enable a successful Cross-site Scripting (XSS attack) when using the products' web server.Show less
CVE-2019-4718 1Ibm 1Jazz For Service Management Jun 17, 2026 Mar 23, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz for Service Management 3.13 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...Show more IBM Jazz for Service Management 3.13 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 172123.Show less
CVE-2019-15510 1Zohocorp 1Manageengine Desktop Central Jun 17, 2026 Mar 23, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ManageEngine_DesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the description of a role.
CVE-2020-10821 1Nagios 1Nagios Xi Jun 17, 2026 Mar 22, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.
CVE-2020-10820 1Nagios 1Nagios Xi Jun 17, 2026 Mar 22, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.
CVE-2020-10819 1Nagios 1Nagios Xi Jun 17, 2026 Mar 22, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter.
CVE-2020-10803 5Debian FedoraprojectOpensuse+2 more 6Backports Sle Debian LinuxFedora+3 more Jun 17, 2026 Mar 22, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.ph...Show more In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.Show less
CVE-2019-13463 1Quantumcloud 1Simple Link Directory Jun 17, 2026 Mar 20, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML, because esc_html is not called for the...Show more An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML, because esc_html is not called for the "echo get_the_title()" or "echo $term->name" statement.Show less
CVE-2019-13389 1Rainloop 1Webmail Jun 17, 2026 Mar 20, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 RainLoop Webmail before 1.13.0 lacks XSS protection mechanisms such as xlink:href validation, the X-XSS-Protection header, and the Content-Security-Policy header.

Previous 1...176017611762...2428 Next