← Back
CWE-79

48,580 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,580)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-12444
1Gitlab
1Gitlab
Jun 17, 2026
Mar 10, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. Wiki Pages contained a lack of input validation which resulted in a persistent XSS vulnerability.
CVE-2019-12442
1Gitlab
1Gitlab
Jun 17, 2026
Mar 10, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. The epic details page contained a lack of input validation and output encoding issue which resulted in a persistent XSS vulnerability on child epic...Show more
An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. The epic details page contained a lack of input validation and output encoding issue which resulted in a persistent XSS vulnerability on child epics.Show less
CVE-2019-11345
1Citrix
2Citrix Sd Wan Center
Netscaler Sd Wan Center
Jun 17, 2026
Mar 10, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow XSS.
CVE-2020-4162
1Ibm
1Infosphere Information Server
Jun 17, 2026
Mar 10, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...Show more
IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174342.Show less
CVE-2019-4608
1Ibm
1Tivoli Workload Scheduler
Jun 17, 2026
Mar 10, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Tivoli Workload Scheduler 9.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cr...Show more
IBM Tivoli Workload Scheduler 9.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168508.Show less
CVE-2020-9758
1Livezilla
1Livezilla
Jun 17, 2026
Mar 9, 2020
N/A· v4
9.6 CRITICAL· v3
4.3 MEDIUM· v2
An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 (Helpdesk). A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in th...Show more
An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 (Helpdesk). A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from unauthenticated to user-level access, leading to full account takeover. The attack fetches multiple credentials because they are stored in the database (stored XSS). This affects the mobile/chat URI via the lgn and psswrd parameters.Show less
CVE-2020-10247
2Misp
Misp Project
2Misp
Misp
Jun 22, 2026
Mar 9, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sighting_field.ctp.
CVE-2020-10246
2Misp
Misp Project
2Misp
Misp
Jun 22, 2026
Mar 9, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp.
CVE-2020-10192
1Munkireport Project
1Munkireport
Jun 17, 2026
Mar 9, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Munkireport before 5.3.0.3923. An unauthenticated actor can send a custom XSS payload through the /report/broken_client endpoint. The payload will be executed by any authenticated users browsin...Show more
An issue was discovered in Munkireport before 5.3.0.3923. An unauthenticated actor can send a custom XSS payload through the /report/broken_client endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/views/listings/default.php.Show less
CVE-2020-10191
1Munkireport Project
1Munkireport
Jun 17, 2026
Mar 9, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in MunkiReport before 5.3.0. An authenticated actor can send a custom XSS payload through the /module/comment/save endpoint. The payload will be executed by any authenticated users browsing the ap...Show more
An issue was discovered in MunkiReport before 5.3.0. An authenticated actor can send a custom XSS payload through the /module/comment/save endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/controllers/client.php:detail.Show less
CVE-2020-4084
1Hcltech
1Connections
Jun 17, 2026
Mar 9, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
HCL Connections v5.5, v6.0, and v6.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading t...Show more
HCL Connections v5.5, v6.0, and v6.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.Show less
CVE-2020-2152
1Jenkins
1Subversion Release Manager
Jun 17, 2026
Mar 9, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, resulting in a reflected cross-site scripting vulnerability.
CVE-2020-2140
1Jenkins
1Audit Trail
Jun 17, 2026
Mar 9, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.
CVE-2020-2137
1Jenkins
1Timestamper
Jun 17, 2026
Mar 9, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Jenkins Timestamper Plugin 1.11.1 and earlier does not sanitize HTML formatting of its output, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.
CVE-2020-2136
1Jenkins
1Git
Jun 17, 2026
Mar 9, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting vulnerability.
CVE-2015-7344
1Hikashop
1Hikashop
Nov 21, 2024
Mar 9, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption].
CVE-2015-7343
1Joobi
1Jnews
Nov 21, 2024
Mar 9, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.
CVE-2020-9281
4Ckeditor
DrupalFedoraproject+1 more
12Agile Plm
Agile Product Lifecycle ManagementApplication Express+9 more
Aug 25, 2026
Mar 7, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected synt...Show more
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).Show less
CVE-2019-19773
1Lexmark
806500e Firmware
C734 FirmwareC736 Firmware+77 more
Jun 17, 2026
Mar 6, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Various Lexmark products have stored XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://support.lexmark.com/index?page=content&id=TE935&locale=en&userlocale...Show more
Various Lexmark products have stored XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://support.lexmark.com/index?page=content&id=TE935&locale=en&userlocale=EN_US.Show less
CVE-2019-19772
1Lexmark
806500e Firmware
C734 FirmwareC736 Firmware+77 more
Jun 17, 2026
Mar 6, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://support.lexmark.com/index?page=content&id=TE935&locale=en&userloc...Show more
Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://support.lexmark.com/index?page=content&id=TE935&locale=en&userlocale=EN_US.Show less