Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,586)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-19599 1Monstra 1Monstra Cms Nov 21, 2024 Mar 2, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product.
CVE-2018-17572 1Influxdata 1Influxdb Nov 21, 2024 Mar 2, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 InfluxDB 0.9.5 has Reflected XSS in the Write Data module.
CVE-2020-8778 1Alfresco 1Alfresco Jun 17, 2026 Mar 2, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document, when the attacker has write access to a project.
CVE-2020-8777 1Alfresco 1Alfresco Jun 17, 2026 Mar 2, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document.
CVE-2020-8776 1Alfresco 1Alfresco Jun 17, 2026 Mar 2, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file.
CVE-2018-15820 1Easyio 1Easyio 30p Firmware Nov 21, 2024 Mar 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 EasyIO EasyIO-30P devices before 2.0.5.27 allow XSS via the dev.htm GDN parameter.
CVE-2019-19371 1Mitel 1Micollab Audio, Web & Video Conferencing Jun 17, 2026 Mar 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to in...Show more A cross-site scripting (XSS) vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation in the join meeting interface. A successful exploit could allow an attacker to execute arbitrary scripts.Show less
CVE-2019-19370 1Mitel 1Micollab Jun 17, 2026 Mar 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability in the web conferencing component of the Mitel MiCollab application before 9.0.15 for Android could allow an unauthenticated attacker to conduct a reflected cross-site scripting...Show more A cross-site scripting (XSS) vulnerability in the web conferencing component of the Mitel MiCollab application before 9.0.15 for Android could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation in the file upload interface. A successful exploit could allow an attacker to execute arbitrary scripts.Show less
CVE-2018-14384 1Seopanel 1Seo Panel Nov 21, 2024 Mar 2, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 The Website Manager module in SEO Panel 3.13.0 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability, allowing remote authenticated attackers to inject arbitrary web script or HTML via the websites...Show more The Website Manager module in SEO Panel 3.13.0 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability, allowing remote authenticated attackers to inject arbitrary web script or HTML via the websites.php name parameter.Show less
CVE-2019-20486 1Netgear 1Wnr1000 Firmware Jun 17, 2026 Mar 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple pages (setup.cgi and adv_index.htm) within the web management console are vulnerable to stored XSS, as demonstrated by the configuration of the UI l...Show more An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple pages (setup.cgi and adv_index.htm) within the web management console are vulnerable to stored XSS, as demonstrated by the configuration of the UI language.Show less
CVE-2020-6798 1Mozilla 3Firefox Firefox EsrThunderbird Jun 17, 2026 Mar 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed. A site that relied on the browser behaving correctly could suffer a cross...Show more If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed. A site that relied on the browser behaving correctly could suffer a cross-site scripting vulnerability as a result. In general, this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but is potentially a risk in browser or browser-like contexts. This vulnerability affects Thunderbird < 68.5, Firefox < 73, and Firefox < ESR68.5.Show less
CVE-2020-6804 1Mozilla 1Webthings Gateway Jun 17, 2026 Feb 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected XSS vulnerability exists within the gateway, allowing an attacker to craft a specialized URL which could steal the user's authentication token. When combined with CVE-2020-6803, an attacker could fully compro...Show more A reflected XSS vulnerability exists within the gateway, allowing an attacker to craft a specialized URL which could steal the user's authentication token. When combined with CVE-2020-6803, an attacker could fully compromise the system.Show less
CVE-2020-9459 1Webnus 1Modern Events Calendar Lite Jun 17, 2026 Feb 28, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users (with minimal permissions) to inject arbitrary Jav...Show more Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users (with minimal permissions) to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mec_save_notifications and import_settings.Show less
CVE-2020-8127 1Revealjs 1Reveal.js Jun 17, 2026 Feb 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient validation in cross-origin communication (postMessage) in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks.
CVE-2020-9447 1Gwtupload Project 1Gwtupload Jun 17, 2026 Feb 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 There is an XSS (cross-site scripting) vulnerability in GwtUpload 1.0.3 in the file upload functionality. Someone can upload a file with a malicious filename, which contains JavaScript code, which would result in XSS. Cr...Show more There is an XSS (cross-site scripting) vulnerability in GwtUpload 1.0.3 in the file upload functionality. Someone can upload a file with a malicious filename, which contains JavaScript code, which would result in XSS. Cross-site scripting enables attackers to steal data, change the appearance of a website, and perform other malicious activities like phishing or drive-by hacking.Show less
CVE-2020-3867 3Apple OpensuseWebkitgtk 8Icloud IpadosIphone Os+5 more Jun 17, 2026 Feb 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A logic issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. P...Show more A logic issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. Processing maliciously crafted web content may lead to universal cross site scripting.Show less
CVE-2015-2992 1Apache 1Struts Nov 21, 2024 Feb 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
CVE-2020-8952 1Fiserv 1Accurate Reconciliation Jun 17, 2026 Feb 26, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the logout.jsp timeOut parameter.
CVE-2020-8951 1Fiserv 1Accurate Reconciliation Jun 17, 2026 Feb 26, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the Source or Destination field of the Configuration Manager (Configuration Parameter Translation) page.
CVE-2019-4596 1Ibm 1Sterling B2b Integrator Jun 17, 2026 Feb 26, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended func...Show more IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 167879.Show less

Previous 1...177417751776...2430 Next