Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,591)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-8514 1Maxum 1Rumpus Jun 17, 2026 Feb 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Rumpus 8.2.10 on macOS. By crafting a directory name, it is possible to activate JavaScript in the context of the web application after invoking the rename folder functionality.
CVE-2020-8512 1Icewarp 1Icewarp Server Jun 17, 2026 Feb 1, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
CVE-2014-8338 1Videowhisper 1Webcam Nov 21, 2024 Jan 31, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in vwrooms/js/jsor-jcarousel/examples/special_textscroller.php in the VideoWhisper Webcam plugins for Drupal 7.x allows remote attackers to inject arbitrary web script or HTML via...Show more Cross-site scripting (XSS) vulnerability in vwrooms/js/jsor-jcarousel/examples/special_textscroller.php in the VideoWhisper Webcam plugins for Drupal 7.x allows remote attackers to inject arbitrary web script or HTML via a URL to a crafted SVG file in the feed parameter.Show less
CVE-2014-5039 1Eucalyptus 1Eucalyptus Management Console Nov 21, 2024 Jan 31, 2020 N/A· v4 9.6 CRITICAL· v3 6.8 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-3809 1Nokia 31830 Photonic Service Switch 16 Firmware 1830 Photonic Service Switch 32 Firmware1830 Photonic Service Switch 4 Firmware Nov 21, 2024 Jan 31, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in the management interface in Alcatel-Lucent 1830 Photonic Service Switch (PSS) 6.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the myurl param...Show more Cross-site scripting (XSS) vulnerability in the management interface in Alcatel-Lucent 1830 Photonic Service Switch (PSS) 6.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the myurl parameter to menu/pop.html.Show less
CVE-2013-3565 2Opensuse Videolan 2Opensuse Vlc Media Player Nov 21, 2024 Jan 31, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) command parameter to requests/...Show more Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) command parameter to requests/vlm_cmd.xml, (2) dir parameter to requests/browse.xml, or (3) URI in a request, which is returned in an error message through share/lua/intf/http.lua.Show less
CVE-2014-2843 1Infoware 1Mapsuite Nov 21, 2024 Jan 31, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in infoware MapSuite MapAPI 1.0.x before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2020-8498 1Gistpress Project 1Gistpress Jun 17, 2026 Jan 30, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbit...Show more XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users (e.g., ones who have the publish_posts capability).Show less
CVE-2020-8496 1Kronos 1Web Time And Attendance Jun 17, 2026 Jan 30, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Application Banner input field of the /ApplicationBanner page as an authenticated admi...Show more In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Application Banner input field of the /ApplicationBanner page as an authenticated administrator.Show less
CVE-2020-8493 1Kronos 1Web Time And Attendance Jun 17, 2026 Jan 30, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fields (Login Message, Banner Message, and Password Instructions) of the com.threeis...Show more A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fields (Login Message, Banner Message, and Password Instructions) of the com.threeis.webta.H261configMenu servlet via an authenticated administrator.Show less
CVE-2013-4241 1Hitmyserver 1Hms Testimonials Nov 21, 2024 Jan 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) te...Show more Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format parameter to the Settings - Default form (hms-testimonials-settings page); (6) name parameter in a Save action to the Settings - Custom Fields form (hms-testimonials-settings-fields page); or (7) name parameter in a Save action to the Settings - Template form (hms-testimonials-templates-new page).Show less
CVE-2013-2294 1Viewgit Project 1Viewgit Nov 21, 2024 Jan 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in ViewGit before 0.0.7 allow remote repository users to inject arbitrary web script or HTML via a (1) tag name to the Shortlog table in templates/shortlog.php or branc...Show more Multiple cross-site scripting (XSS) vulnerabilities in ViewGit before 0.0.7 allow remote repository users to inject arbitrary web script or HTML via a (1) tag name to the Shortlog table in templates/shortlog.php or branch name to the (2) Shortlog table in templates/shortlog.php or (3) Heads table in plates/summary.php.Show less
CVE-2012-6133 1Roundup Tracker 1Roundup Nov 21, 2024 Jan 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_message or (2) @error_message parameter to issue*.
CVE-2014-3718 1Exlibrisgroup 1Aleph 500 Nov 21, 2024 Jan 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/tag_m.cgi in Ex Libris ALEPH 500 (Integrated library management system) 18.1 and 20 allow remote attackers to inject arbitrary web script or HTML via the (1)...Show more Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/tag_m.cgi in Ex Libris ALEPH 500 (Integrated library management system) 18.1 and 20 allow remote attackers to inject arbitrary web script or HTML via the (1) find, (2) lib, or (3) sid parameter.Show less
CVE-2020-7913 1Jetbrains 1Youtrack Jun 17, 2026 Jan 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description.
CVE-2020-7911 1Jetbrains 1Teamcity Jun 17, 2026 Jan 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS.
CVE-2020-7910 1Jetbrains 1Teamcity Jun 17, 2026 Jan 30, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.
CVE-2013-0739 1Chamilo 1Chamilo Nov 21, 2024 Jan 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Chamilo 1.9.4 has XSS due to improper validation of user-supplied input by the chat.php script.
CVE-2013-0738 1Chamilo 1Chamilo Nov 21, 2024 Jan 30, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Chamilo 1.9.4 has Multiple XSS and HTML Injection Vulnerabilities: blog.php and announcements.php.
CVE-2013-3320 1Netapp 1Oncommand System Manager Nov 21, 2024 Jan 29, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to inject arbitrary web script or HTML via the 'full-name' and 'comment' fields.

Previous 1...178317841785...2430 Next