Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,602)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2011-3610 1S9y 1Serendipity Event Freetag Nov 21, 2024 Jan 22, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud parameter to plugins/serendipity_event_freetag/tagcloud.swf.
CVE-2011-3595 1Joomla 1Joomla Nov 21, 2024 Jan 22, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters.
CVE-2020-7228 1Codepeople 1Calculated Fields Form Jun 17, 2026 Jan 22, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These can be exploited by an authenticated user.
CVE-2018-17981 1Lifesize 2Express 220 Firmware Room 220i Firmware Nov 21, 2024 Jan 22, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Lifesize Express ls ex2_4.7.10 2000 (14) devices allow XSS via the interface/interface.php brand parameter.
CVE-2019-18426 1Whatsapp 1Whatsapp Jun 17, 2026 Jan 21, 2020 N/A· v4 8.2 HIGH· v3 5.8 MEDIUM· v2 A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the...Show more A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.Show less
CVE-2019-19592 1Jamasoftware 1Connect Jun 17, 2026 Jan 21, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Jama Connect 8.44.0 is vulnerable to stored Cross-Site Scripting
CVE-2020-7470 1Sonoff 2Th10 Firmware Th16 Firmware Jun 17, 2026 Jan 21, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Sonoff TH 10 and 16 devices with firmware 6.6.0.21 allows XSS via the Friendly Name 1 field (after a successful login with the Web Admin Password).
CVE-2011-4095 1Jara Project 1Jara Nov 21, 2024 Jan 21, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Jara 1.6 has an XSS vulnerability
CVE-2020-7239 1Ibm 1Chatbot With Ibm Watson Jun 17, 2026 Jan 21, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent.
CVE-2020-7249 1Smc 1D3g0804 Firmware Jun 17, 2026 Jan 21, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 SMC D3G0804W 3.5.2.5-LAT_GA devices allow XSS via the SSID field on the WiFi Network Configuration page (after a successful login to the admin account).
CVE-2019-20381 1Testlink 1Testlink Jun 17, 2026 Jan 20, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exists because of an incomplete fix for CVE-2019-19491.
CVE-2020-7236 1Uhp 1Uhp 100 Firmware Jun 17, 2026 Jan 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 UHP UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3 devices allow XSS via cw2?td= (Site Name field of the Site Setup section).
CVE-2020-7235 1Uhp 1Uhp 100 Firmware Jun 17, 2026 Jan 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 UHP UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3 devices allow XSS via cB3?ta= (profile title).
CVE-2020-7234 1Ruckuswireless 1R310 Firmware Jun 17, 2026 Jan 19, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Ruckus ZoneFlex R310 104.0.0.0.1347 devices allow Stored XSS via the SSID field on the Configuration > Radio 2.4G > Wireless X screen (after a successful login to the super account).
CVE-2020-7104 1Kibokolabs 1Chained Quiz Jun 17, 2026 Jan 17, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter.
CVE-2019-17634 1Eclipse 1Memory Analyzer Jun 17, 2026 Jan 17, 2020 N/A· v4 9.0 CRITICAL· v3 8.5 HIGH· v2 Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report from a malicious heap dump. The user must chose todownload, open the malicious hea...Show more Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report from a malicious heap dump. The user must chose todownload, open the malicious heap dump and generate an HTML report for the problem to occur. The heap dump could be specially crafted, or could come from a crafted application or from an application processing malicious data. The vulnerability is present whena report is generated and opened from the Memory Analyzer graphical user interface, or when a report generated in batch mode is then opened in Memory Analyzer or by a web browser. The vulnerability could possibly allow code execution on the local system whenthe report is opened in Memory Analyzer.Show less
CVE-2019-17127 1Solarwinds 1Orion Platform Jun 17, 2026 Jan 17, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbo...Show more A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege escalation.Show less
CVE-2019-17125 1Solarwinds 1Orion Platform Jun 17, 2026 Jan 17, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achi...Show more A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS.Show less
CVE-2019-10957 1Geutebrueck 11G Cam Ebc 2110 Firmware G Cam Ebc 2111 FirmwareG Cam Efd 2240 Firmware+8 more Jun 17, 2026 Jan 17, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated attacker with access to event configuration to store malicious code...Show more Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated attacker with access to event configuration to store malicious code on the server, which could later be triggered by a legitimate user resulting in code execution within the user’s browser.Show less
CVE-2019-20003 1Dicube 1Easescreen Crystal Jun 17, 2026 Jan 17, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Feldtech easescreen Crystal 9.0 Web-Services 9.0.1.16265 allows Stored XSS via the Debug-Log and Display-Log components. This could be exploited when an attacker sends an crafted string for FTP authentication.

Previous 1...178817891790...2431 Next