Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,589)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2011-1086 1Openfiler 1Openfiler Nov 21, 2024 Feb 7, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in admin/system.html in Openfiler 2.3 allows remote attackers to inject arbitrary web script or HTML via the device parameter.
CVE-2011-1084 1Smoothwall 1Smoothwall Express Nov 21, 2024 Feb 7, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability in Smoothwall Express 3.
CVE-2013-3067 1Linksys 1Wrt310n Firmware Nov 21, 2024 Feb 7, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Linksys WRT310Nv2 2.0.0.1 is vulnerable to XSS.
CVE-2014-6413 1Watchguard 1Fireware Xtm Nov 21, 2024 Feb 7, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Cross-site Scripting (XSS) vulnerability exists in WatchGuard XTM 11.8.3 via the poll_name parameter in the firewall/policy script.
CVE-2013-3637 1Projectpier 1Projectpier Nov 21, 2024 Feb 7, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 ProjectPier 0.8.8 does not use the Secure flag for cookies
CVE-2013-3636 1Projectpier 1Projectpier Nov 21, 2024 Feb 7, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flag
CVE-2013-3635 1Projectpier 1Projectpier Nov 21, 2024 Feb 7, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 ProjectPier 0.8.8 has stored XSS
CVE-2020-8788 1Synaptivemedical 1Clearcanvas Jun 17, 2026 Feb 7, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS (and HTML injection) via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from...Show more Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS (and HTML injection) via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public bug report.Show less
CVE-2013-2008 1Automattic 1Wp Super Cache Nov 21, 2024 Feb 7, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 WordPress Super Cache Plugin 1.3 has XSS.
CVE-2013-2684 1Cisco 1Linksys E4200 Firmware Nov 21, 2024 Feb 6, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site Scripting (XSS) in Cisco Linksys E4200 1.0.05 Build 7 devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2020-5317 1Dell 1Emc Elastic Cloud Storage Jun 17, 2026 Feb 6, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Dell EMC ECS versions prior to 3.4.0.1 contain an XSS vulnerability. A remote authenticated malicious user could exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store....Show more Dell EMC ECS versions prior to 3.4.0.1 contain an XSS vulnerability. A remote authenticated malicious user could exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application.Show less
CVE-2012-2593 1Atmail 1Atmail Nov 21, 2024 Feb 6, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or HTML via the Date field of an email.
CVE-2020-5528 1Sixapart 1Movable Type Jun 17, 2026 Feb 6, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4603 and earlier (Movable Type 7), Movable Type 6.5.2 and earlier (Movable Type 6.5), Movable Type Advanced 7 r.4603 and earlier (Movable Type A...Show more Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4603 and earlier (Movable Type 7), Movable Type 6.5.2 and earlier (Movable Type 6.5), Movable Type Advanced 7 r.4603 and earlier (Movable Type Advanced 7), Movable Type Advanced 6.5.2 and earlier (Movable Type Advanced 6.5), Movable Type Premium 1.26 and earlier (Movable Type Premium), and Movable Type Premium Advanced 1.26 and earlier (Movable Type Premium Advanced)) allows remote attackers to inject arbitrary web script or HTML in the block editor and the rich text editor via a specially crafted URL.Show less
CVE-2011-1150 1Bbpress 1Bbpress Nov 21, 2024 Feb 5, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter.
CVE-2020-6854 1Sos Berlin 1Jobscheduler Jun 17, 2026 Feb 5, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A cross-site scripting (XSS) vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to inject arbitrary web script or HTML via JSON properties available from the REST API.
CVE-2011-1069 1Phpshop 1Phpshop Nov 21, 2024 Feb 5, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 PHPShop through 0.8.1 has XSS.
CVE-2011-1009 1Vanillaforums 1Vanilla Nov 21, 2024 Feb 5, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Vanilla Forums 2.0.17.1 through 2.0.17.5 has XSS in /vanilla/index.php via the p parameter.
CVE-2019-20173 1Auth0 1Login By Auth0 Jun 17, 2026 Feb 5, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.
CVE-2010-4662 1Pmwiki 1Pmwiki Nov 21, 2024 Feb 5, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 PmWiki before 2.2.21 has XSS.
CVE-2020-3149 1Cisco 1Identity Services Engine Jun 17, 2026 Feb 5, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack on an affected de...Show more A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack on an affected device. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by providing malicious data to a specific field within the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Cisco ISE Software releases 2.7.0 and later contains the fix for this vulnerability.Show less

Previous 1...178117821783...2430 Next