Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,591)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-3758 1Magento 1Magento Jun 17, 2026 Jan 29, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosu...Show more Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.Show less
CVE-2020-3715 1Magento 1Magento Jun 17, 2026 Jan 29, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosu...Show more Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.Show less
CVE-2020-2106 1Jenkins 1Code Coverage Api Jun 17, 2026 Jan 29, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job configurations.
CVE-2019-7655 1Wowza 1Streaming Engine Jun 17, 2026 Jan 29, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the (1) customList%5B0%5D.value field in enginemanager/server/serversetup/edit_adv.htm of the Server Setup configuration or the...Show more Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the (1) customList%5B0%5D.value field in enginemanager/server/serversetup/edit_adv.htm of the Server Setup configuration or the (2) host field in enginemanager/j_spring_security_check of the login form. This issue was resolved in Wowza Streaming Engine 4.8.5.Show less
CVE-2013-0161 1Havalite 1Havalite Nov 21, 2024 Jan 29, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Havalite CMS 1.1.7 has a stored XSS vulnerability
CVE-2012-5776 1Dokeos 1Dokeos Nov 21, 2024 Jan 29, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Dokeos 2.1.1 has multiple XSS issues involving "extra_" parameters in main/auth/profile.php.
CVE-2020-8426 1Elementor 1Website Builder Jun 17, 2026 Jan 28, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be exploited by targeting an authenticated user.
CVE-2020-8421 1Joomla 1Joomla Jun 17, 2026 Jan 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in com_actionlogs.
CVE-2014-8490 1Tennisconnect 1Components Nov 21, 2024 Jan 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in TennisConnect COMPONENTS 9.927 allows remote attackers to inject arbitrary web script or HTML via the pid parameter to index.cfm.
CVE-2013-2714 1Podpress Project 1Podpress Nov 21, 2024 Jan 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site Scripting (XSS) in WordPress podPress Plugin 8.8.10.13 could allow remote attackers to inject arbitrary web script or html via the 'playerID' parameter.
CVE-2019-4632 1Ibm 1Security Secret Server Jun 17, 2026 Jan 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cred...Show more IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170004.Show less
CVE-2019-17338 1Tibco 1Patterns Search Jun 17, 2026 Jan 28, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The user interface component of TIBCO Software Inc.'s TIBCO Patterns - Search contains multiple vulnerabilities that theoretically allow authenticated users to perform persistent cross-site scripting (XSS) attacks. Affec...Show more The user interface component of TIBCO Software Inc.'s TIBCO Patterns - Search contains multiple vulnerabilities that theoretically allow authenticated users to perform persistent cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Patterns - Search: versions 5.4.0 and below.Show less
CVE-2013-6451 1Mediawiki 1Mediawiki Nov 21, 2024 Jan 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via unspecified CSS values.
CVE-2020-7934 1Liferay 1Liferay Portal Jun 17, 2026 Jan 28, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a...Show more In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload will then be rendered when a user utilizes the search feature to search for other users (i.e., if a user with modified fields occurs in the search results). This issue was fixed in Liferay Portal CE version 7.3.0 GA1.Show less
CVE-2020-7997 1Asus 1Rt Ac66u Firmware Jun 17, 2026 Jan 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ASUS WRT-AC66U 3 RT 3.0.0.4.372_67 devices allow XSS via the Client Name field to the Parental Control feature.
CVE-2019-15607 1Nodered 1Node Red Jun 17, 2026 Jan 28, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web ap...Show more A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc.Show less
CVE-2019-15586 1Gitlab 1Gitlab Jun 17, 2026 Jan 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin.
CVE-2020-1933 1Apache 1Nifi Jun 17, 2026 Jan 28, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers.
CVE-2019-20439 1Wso2 1Api Manager Jun 17, 2026 Jan 28, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in defining a scope in the "manage the API" page of the API Publisher.
CVE-2019-20438 1Wso2 1Api Manager Jun 17, 2026 Jan 28, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in WSO2 API Manager 2.6.0. A potential stored Cross-Site Scripting (XSS) vulnerability has been identified in the inline API documentation editor page of the API Publisher.

Previous 1...178417851786...2430 Next