← Back
CWE-79

46,217 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (46,217)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-1912
1Ibm
1Rational Doors Next Generation
Nov 21, 2024
Mar 6, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM DOORS Next Generation (DNG/RRC) 6.0.2 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality pot...Show more
IBM DOORS Next Generation (DNG/RRC) 6.0.2 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152736.Show less
CVE-2018-1911
1Ibm
1Rational Doors Next Generation
Nov 21, 2024
Mar 6, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.2 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intend...Show more
IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.2 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152735.Show less
CVE-2019-9595
1Appcms
1Appcms
Jun 17, 2026
Mar 6, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
AppCMS 2.0.101 allows XSS via the upload/callback.php params parameter.
CVE-2019-9593
1Mitel
1Connect Onsite
Jun 17, 2026
Mar 6, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVE-2019-9592
1Mitel
1Connect Onsite
Jun 17, 2026
Mar 6, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVE-2019-9591
1Mitel
1Connect Onsite
Jun 17, 2026
Mar 6, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE before 19.49.1500.0 allows remote attackers to inject arbitrary web script or HTML via the brandUrl parameter.
CVE-2019-0743
1Microsoft
1Team Foundation Server
Jun 17, 2026
Mar 5, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CV...Show more
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0742.Show less
CVE-2019-0742
1Microsoft
1Team Foundation Server
Jun 17, 2026
Mar 5, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CV...Show more
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0743.Show less
CVE-2019-0668
1Microsoft
1Sharepoint Enterprise Server
Jun 17, 2026
Mar 5, 2019
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Elevation of Privileg...Show more
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'.Show less
CVE-2019-9576
1Adenion
1Blog2social
Jun 17, 2026
Mar 5, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS.
CVE-2019-9575
1Quizandsurveymaster
1Quiz And Survey Master
Jun 17, 2026
Mar 5, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.
CVE-2019-6565
1Moxa
4Eds 405a Firmware
Eds 408a FirmwareEds 510a Firmware+1 more
Jun 17, 2026
Mar 5, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attacks, which may be used to send a malicious script.
CVE-2019-6528
1Psigridconnect
5Iec104 Security Proxy Firmware
Smart Telecontrol Unit Tcg FirmwareTelecontrol Gateway 3g Firmware+2 more
Jun 17, 2026
Mar 5, 2019
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions...Show more
PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway VM Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Smart Telecontrol Unit TCG Versions 5.0.27, 5.1.19, 6.0.16 and prior, and IEC104 Security Proxy Version 2.2.10 and prior The web application browser interprets input as active HTML, JavaScript, or VBScript, which could allow an attacker to execute arbitrary code.Show less
CVE-2019-4029
1Ibm
1Sterling B2b Integrator
Jun 17, 2026
Mar 5, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potenti...Show more
IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-force ID: 155907.Show less
CVE-2019-4028
1Ibm
1Sterling B2b Integrator
Jun 17, 2026
Mar 5, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potenti...Show more
IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155906.Show less
CVE-2019-4027
1Ibm
1Sterling B2b Integrator
Jun 17, 2026
Mar 5, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potenti...Show more
IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-ForceID: 155905.Show less
CVE-2019-6229
1Apple
5Icloud
Iphone OsItunes+2 more
Jun 17, 2026
Mar 5, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A logic issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead...Show more
A logic issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to universal cross site scripting.Show less
CVE-2019-6228
1Apple
2Iphone Os
Safari
Jun 17, 2026
Mar 5, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue is fixed in iOS 12.1.3, Safari 12.0.3. Processing maliciously crafted web content may lead to a cross site...Show more
A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue is fixed in iOS 12.1.3, Safari 12.0.3. Processing maliciously crafted web content may lead to a cross site scripting attack.Show less
CVE-2019-9570
1Yzmcms
1Yzmcms
Jun 17, 2026
Mar 5, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/system_manage/save.html URI, related to the site_code parameter.
CVE-2017-15515
1Netapp
1Snapcenter Server
Nov 21, 2024
Mar 4, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
NetApp SnapCenter Server prior to 4.0 is susceptible to cross site scripting vulnerability that could allow a privileged user to inject arbitrary scripts into the custom secondary policy label field.