Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,589)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2013-4395 1Simplemachines 1Simple Machines Forum Nov 21, 2024 Feb 12, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Simple Machines Forum (SMF) through 2.0.5 has XSS
CVE-2013-1938 1Zimbra 1Zimbra Nov 21, 2024 Feb 12, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Zimbra 2013 has XSS in aspell.php
CVE-2020-8839 1Chiyu T 1Bf 430 Firmware Jun 17, 2026 Feb 12, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cgi TF_submask field.
CVE-2020-2122 1Jenkins 1Brakeman Jun 17, 2026 Feb 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resulting in a stored cross-site scripting vulnerability exploitable by users able to control the Brakem...Show more Jenkins Brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resulting in a stored cross-site scripting vulnerability exploitable by users able to control the Brakeman post-build step input data.Show less
CVE-2020-2113 1Jenkins 1Git Parameter Jun 17, 2026 Feb 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission.
CVE-2020-2112 1Jenkins 1Git Parameter Jun 17, 2026 Feb 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission.
CVE-2020-2111 1Jenkins 1Subversion Jun 17, 2026 Feb 12, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored cross-site scripting vulnerability.
CVE-2013-1410 1Perforce 1P4web Nov 21, 2024 Feb 12, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Perforce P4web 2011.1 and 2012.1 has multiple XSS vulnerabilities
CVE-2020-0694 1Microsoft 1Sharepoint Enterprise Server Jun 17, 2026 Feb 11, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnera...Show more A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0693.Show less
CVE-2020-0693 1Microsoft 1Sharepoint Enterprise Server Jun 17, 2026 Feb 11, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnera...Show more A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0694.Show less
CVE-2013-4225 1Restful Web Services Project 1Restful Web Services Nov 21, 2024 Feb 11, 2020 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users wit...Show more The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.Show less
CVE-2011-4938 1Muze 1Ariadne Nov 21, 2024 Feb 11, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in Ariadne 2.7.6 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO parameter to (1) index.php and (2) loader.php.
CVE-2012-6720 1Socialengine 1Socialengine Nov 21, 2024 Feb 11, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in SocialEngine before 4.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to music/create, (2) location parameter to events...Show more Multiple cross-site scripting (XSS) vulnerabilities in SocialEngine before 4.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to music/create, (2) location parameter to events/create, or (3) search parameter to widget/index/content_id/*.Show less
CVE-2012-2517 1Prestashop 1Prestashop Nov 21, 2024 Feb 11, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product[] parameter to ajax.php.
CVE-2012-2452 1Pragmamx 1Pragmamx Nov 21, 2024 Feb 11, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in pragmaMx 1.x before 1.12.2 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter to modules.php or (2) img_url to includes/wysiwyg...Show more Multiple cross-site scripting (XSS) vulnerabilities in pragmaMx 1.x before 1.12.2 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter to modules.php or (2) img_url to includes/wysiwyg/spaw/editor/plugins/imgpopup/img_popup.php.Show less
CVE-2014-3827 1Mybb 1Mybb Nov 21, 2024 Feb 11, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Multiple cross-site scripting (XSS) vulnerabilities in the MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the (1) edit or (2) ad...Show more Multiple cross-site scripting (XSS) vulnerabilities in the MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the (1) edit or (2) add action in the user-users module or the (3) finduser action or the name parameter in an (4) edit action in the user-user module or the (5) editprofile action to modcp.php.Show less
CVE-2014-3826 1Mybb 1Mybb Nov 21, 2024 Feb 11, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter in the edit action of the config-profile_fields module.
CVE-2013-5988 1Semperplugins 1All In One Seo Pack Nov 21, 2024 Feb 11, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack plugin before 2.0.3.1 for WordPress via the Search parameter.
CVE-2013-1760 1Thebuggenie 1The Bug Genie Nov 21, 2024 Feb 11, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Bug Genie before 3.2.6 has Multiple XSS and HTML Injection Vulnerabilities
CVE-2012-4519 1Zenphoto 1Zenphoto Nov 21, 2024 Feb 11, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Zenphoto before 1.4.3.4 admin-news-articles.php date parameter XSS.

Previous 1...177917801781...2430 Next