← Back
CWE-79

48,589 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,589)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2014-6447
1Juniper
1Junos
Nov 21, 2024
Feb 11, 2020
N/A· v4
7.1 HIGH· v3
5.8 MEDIUM· v2
Multiple vulnerabilities exist in Juniper Junos J-Web error handling that may lead to cross site scripting (XSS) issues or crash the J-Web service (DoS). This affects Juniper Junos OS 12.1X44 before 12.1X44-D45, 12.1X46...Show more
Multiple vulnerabilities exist in Juniper Junos J-Web error handling that may lead to cross site scripting (XSS) issues or crash the J-Web service (DoS). This affects Juniper Junos OS 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D20, 12.3 before 12.3R8, 12.3X48 before 12.3X48-D10, 13.1 before 13.1R5, 13.2 before 13.2R6, 13.3 before 13.3R4, 14.1 before 14.1R3, 14.1X53 before 14.1X53-D10, 14.2 before 14.2R1, and 15.1 before 15.1R1.Show less
CVE-2020-6392
6Debian
FedoraprojectGoogle+3 more
8Backports Sle
ChromeDebian Linux+5 more
Jun 17, 2026
Feb 11, 2020
N/A· v4
4.3 MEDIUM· v3
4.3 MEDIUM· v2
Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extens...Show more
Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.Show less
CVE-2020-6391
6Debian
FedoraprojectGoogle+3 more
8Backports Sle
ChromeDebian Linux+5 more
Jun 17, 2026
Feb 11, 2020
N/A· v4
4.3 MEDIUM· v3
4.3 MEDIUM· v2
Insufficient validation of untrusted input in Blink in Google Chrome prior to 80.0.3987.87 allowed a local attacker to bypass content security policy via a crafted HTML page.
CVE-2019-18210
1Moodle
1Moodle
Jun 17, 2026
Feb 11, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject JavaScript into the session of another user (e.g., enrolled student or site administrator) via the in...Show more
Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject JavaScript into the session of another user (e.g., enrolled student or site administrator) via the introeditor[text] parameter. NOTE: the discoverer and vendor disagree on whether Moodle customers have a reasonable expectation that anyone authenticated as a Teacher can be trusted with the ability to add arbitrary JavaScript (this ability is not documented on Moodle's Teacher_role page). Because the vendor has this expectation, they have stated "this report has been closed as a false positive, and not a bug."Show less
CVE-2019-19661
1Maxum
1Rumpus Ftp
Jun 17, 2026
Feb 10, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A Cookie based reflected XSS exists in the Web File Manager of Rumpus FTP Server 8.2.9.1, related to RumpusLoginUserName and snp.
CVE-2020-8089
1Piwigo
1Piwigo
Jun 17, 2026
Feb 10, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page.
CVE-2020-1697
1Redhat
2Keycloak
Single Sign On
Jun 17, 2026
Feb 10, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user coul...Show more
It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.Show less
CVE-2012-6449
1Cpanel
2Cpanel
Whm
Nov 21, 2024
Feb 10, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability.
CVE-2013-1353
1Orangehrm
1Orangehrm
Nov 21, 2024
Feb 10, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Orange HRM 2.7.1 allows XSS via the vacancy name.
CVE-2012-6666
1Vbseo
1Vbseo
Nov 21, 2024
Feb 10, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
vBSeo before 3.6.0PL2 allows XSS via the member.php u parameter.
CVE-2020-8825
1Vanillaforums
1Vanilla
Jun 17, 2026
Feb 10, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.
CVE-2020-8823
1Sockjs Project
1Sockjs
Jun 17, 2026
Feb 10, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.
CVE-2020-8822
1Digi
2Transport Wr21 Firmware
Transport Wr44 Firmware
Jun 17, 2026
Feb 10, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Digi TransPort WR21 5.2.2.3, WR44 5.1.6.4, and WR44v2 5.1.6.9 devices allow stored XSS in the web application.
CVE-2015-2207
1Netcracker
1Resource Management System
Nov 21, 2024
Feb 8, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Multiple cross-site scripting (XSS) vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) ctrl, (2) t90001_0_theform_selec...Show more
Multiple cross-site scripting (XSS) vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) ctrl, (2) t90001_0_theform_selection, (3) _scroll, (4) tableName, (5) parent, (6) circuit, (7) return, (8) xname, or (9) mpTransactionId parameter.Show less
CVE-2012-4029
1Chamilo
1Chamilo
Nov 21, 2024
Feb 8, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML via the category_name parameter in an addsentcategory action...Show more
Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML via the category_name parameter in an addsentcategory action.Show less
CVE-2015-1394
110web
1Photo Gallery
Nov 21, 2024
Feb 8, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3)...Show more
Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3) items_view, (4) dir, (5) clipboard_task, (6) clipboard_files, (7) clipboard_src, or (8) clipboard_dest parameters in an addImages action to wp-admin/admin-ajax.php.Show less
CVE-2014-9470
1Fork Cms
1Fork Cms
Nov 21, 2024
Feb 8, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork CMS before 3.8.4 allows remote attackers to inject arbitrary web script or HTML via the q_widget para...Show more
Cross-site scripting (XSS) vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork CMS before 3.8.4 allows remote attackers to inject arbitrary web script or HTML via the q_widget parameter to en/search.Show less
CVE-2014-9126
1Open School
1Open School
Nov 21, 2024
Feb 8, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YII_CSRF_TOKEN HTTP cookie or the StudentDocument, StudentCat...Show more
Multiple cross-site scripting (XSS) vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YII_CSRF_TOKEN HTTP cookie or the StudentDocument, StudentCategories, StudentPreviousDatas parameters to index.php.Show less
CVE-2011-3642
1Flowplayer
1Flowplayer Flash
Nov 21, 2024
Feb 8, 2020
N/A· v4
9.6 CRITICAL· v3
6.8 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the...Show more
Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin.Show less
CVE-2020-8812
1Bludit
1Bludit
Jun 17, 2026
Feb 7, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's perspective is that this is "not a bug.