← Back
CWE-79

48,602 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,602)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-20441
1Wso2
1Api Manager
Jun 17, 2026
Jan 28, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in WSO2 API Manager 2.6.0. A potential Stored Cross-Site Scripting (XSS) vulnerability has been identified in the 'implement phase' of the API Publisher.
CVE-2019-20440
1Wso2
1Api Manager
Jun 17, 2026
Jan 28, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the update API documentation feature of the API Publisher.
CVE-2020-8091
1Typo3
1Typo3
Jun 17, 2026
Jan 27, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. This may be at a contrib/websvg/svg.swf pathna...Show more
svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname.Show less
CVE-2020-8090
1A1
1Wlan Box Adb Vv2220 Firmware
Jun 17, 2026
Jan 27, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
The Username field in the Storage Service settings of A1 WLAN Box ADB VV2220v2 devices allows stored XSS (after a successful Administrator login).
CVE-2012-6448
1Cpanel
1Webhost Manager
Nov 21, 2024
Jan 27, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2019-8947
1Zimbra
1Collaboration Server
Jun 17, 2026
Jan 27, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Zimbra Collaboration 8.7.x - 8.8.11P2 contains non-persistent XSS.
CVE-2019-8946
1Zimbra
1Collaboration Server
Jun 17, 2026
Jan 27, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS.
CVE-2019-8945
1Zimbra
1Collaboration Server
Jun 17, 2026
Jan 27, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS.
CVE-2019-15313
1Zimbra
1Collaboration Server
Jun 17, 2026
Jan 27, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability.
CVE-2019-12427
1Zimbra
1Collaboration Server
Jun 17, 2026
Jan 27, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Zimbra Collaboration before 8.8.15 Patch 1 is vulnerable to a non-persistent XSS via the Admin Console.
CVE-2019-11318
1Synacor
1Zimbra Collaboration Server
Jun 17, 2026
Jan 27, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS.
CVE-2015-2249
1Synacor
1Zimbra Collaboration Server
Nov 21, 2024
Jan 27, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Zimbra Collaboration before 8.6.0 patch5 has XSS.
CVE-2014-5500
1Synacor
1Zimbra Collaboration Server
Nov 21, 2024
Jan 27, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Synacor Zimbra Collaboration before 8.0.8 has XSS.
CVE-2013-4770
1Eucalyptus
1Eucalyptus Management Console
Nov 21, 2024
Jan 27, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-0286
1Pinboard Project
1Pinboard
Nov 21, 2024
Jan 27, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Pinboard 1.0.6 theme for Wordpress has XSS.
CVE-2019-6036
1F Revocrm
1F Revocrm
Jun 17, 2026
Jan 27, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2020-7996
1Dolibarr
1Dolibarr Erp/crm
Jun 17, 2026
Jan 26, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header.
CVE-2020-7994
1Dolibarr
1Dolibarr Erp/crm
Jun 17, 2026
Jan 26, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] parameter to the /htdocs/admin/dict.php?id=3 page; the (2) n...Show more
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] parameter to the /htdocs/admin/dict.php?id=3 page; the (2) name[constname] parameter to the /htdocs/admin/const.php?mainmenu=home page; the (3) note[note] parameter to the /htdocs/admin/dict.php?id=10 page; the (4) zip[MAIN_INFO_SOCIETE_ZIP] or email[mail] parameter to the /htdocs/admin/company.php page; the (5) url[defaulturl], field[defaultkey], or value[defaultvalue] parameter to the /htdocs/admin/defaultvalues.php page; the (6) key[transkey] or key[transvalue] parameter to the /htdocs/admin/translation.php page; or the (7) [main_motd] or [main_home] parameter to the /htdocs/admin/ihm.php page.Show less
CVE-2020-7990
1Adive
1Framework
Jun 17, 2026
Jan 26, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Adive Framework 2.0.8 has admin/user/add userName XSS.
CVE-2020-7989
1Adive
1Framework
Jun 17, 2026
Jan 26, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Adive Framework 2.0.8 has admin/user/add userUsername XSS.