← Back
CWE-79

48,563 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,563)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-0894
1Microsoft
3Sharepoint Enterprise Server
Sharepoint FoundationSharepoint Server
Jun 17, 2026
Mar 12, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnera...Show more
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0893.Show less
CVE-2020-0893
1Microsoft
2Sharepoint Enterprise Server
Sharepoint Server
Jun 17, 2026
Mar 12, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnera...Show more
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0894.Show less
CVE-2020-0891
1Microsoft
3Sharepoint Enterprise Server
Sharepoint FoundationSharepoint Server
Jun 17, 2026
Mar 12, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a speciall...Show more
This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server, aka 'Microsoft SharePoint Reflective XSS Vulnerability'. This CVE ID is unique from CVE-2020-0795.Show less
CVE-2020-0872
1Microsoft
1Application Inspector
Jun 17, 2026
Mar 12, 2020
N/A· v4
9.6 CRITICAL· v3
6.8 MEDIUM· v2
A remote code execution vulnerability exists in Application Inspector version v1.0.23 or earlier when the tool reflects example code snippets from third-party source files into its HTML output, aka 'Remote Code Execution...Show more
A remote code execution vulnerability exists in Application Inspector version v1.0.23 or earlier when the tool reflects example code snippets from third-party source files into its HTML output, aka 'Remote Code Execution Vulnerability in Application Inspector'.Show less
CVE-2020-0795
1Microsoft
3Business Productivity Servers
Sharepoint Enterprise ServerSharepoint Foundation
Jun 17, 2026
Mar 12, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a speciall...Show more
This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server, aka 'Microsoft SharePoint Reflective XSS Vulnerability'. This CVE ID is unique from CVE-2020-0891.Show less
CVE-2020-0700
1Microsoft
2Azure Devops Server
Team Foundation Server
Jun 17, 2026
Mar 12, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site Scripting Vulnerability'.
CVE-2020-8436
1Metagauss
1Registrationmagic
Jun 17, 2026
Mar 12, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name parameter.
CVE-2020-10477
1Chadhaajay
1Phpkb
Jun 17, 2026
Mar 12, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Reflected XSS in admin/manage-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
CVE-2020-10476
1Chadhaajay
1Phpkb
Jun 17, 2026
Mar 12, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Reflected XSS in admin/manage-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
CVE-2020-10475
1Chadhaajay
1Phpkb
Jun 17, 2026
Mar 12, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Reflected XSS in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
CVE-2020-10474
1Chadhaajay
1Phpkb
Jun 17, 2026
Mar 12, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Reflected XSS in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
CVE-2020-10473
1Chadhaajay
1Phpkb
Jun 17, 2026
Mar 12, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Reflected XSS in admin/manage-categories.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
CVE-2020-10472
1Chadhaajay
1Phpkb
Jun 17, 2026
Mar 12, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Reflected XSS in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
CVE-2020-10471
1Chadhasoftware
1Phpkb
Jun 17, 2026
Mar 12, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Reflected XSS in admin/manage-articles.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
CVE-2020-10470
1Chadhaajay
1Phpkb
Jun 17, 2026
Mar 12, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Reflected XSS in admin/manage-fields.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
CVE-2020-10469
1Chadhaajay
1Phpkb
Jun 17, 2026
Mar 12, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Reflected XSS in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort.
CVE-2020-10468
1Chadhaajay
1Phpkb
Jun 17, 2026
Mar 12, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Reflected XSS in admin/edit-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
CVE-2020-10467
1Chadhaajay
1Phpkb
Jun 17, 2026
Mar 12, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Reflected XSS in admin/edit-comment.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
CVE-2020-10466
1Chadhaajay
1Phpkb
Jun 17, 2026
Mar 12, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Reflected XSS in admin/edit-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.
CVE-2020-10465
1Chadhaajay
1Phpkb
Jun 17, 2026
Mar 12, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Reflected XSS in admin/edit-category.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p.