Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,604)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-0656 1Microsoft 1Dynamics 365 Jun 17, 2026 Jan 14, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 (On-Premise) Cr...Show more A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability'.Show less
CVE-2011-2714 1Drupal 2Data Drupal Nov 21, 2024 Jan 14, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or labels before display.
CVE-2011-3202 1Jcow 1Jcow Cms Nov 21, 2024 Jan 14, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Cross-Site Scripting (XSS) vulnerability exists in the g parameter to index.php in Jcow CMS 4.2 and earlier.
CVE-2011-3183 1Concretecms 1Concrete Cms Nov 21, 2024 Jan 14, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier.
CVE-2011-2706 1Snewscms 1Snews Nov 21, 2024 Jan 14, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Cross-Site Scripting (XSS) vulnerability exists in the reorder administrator functions in sNews 1.71.
CVE-2020-6305 1Sap 1Process Integration Jun 17, 2026 Jan 14, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVE-2020-6303 1Sap 1Disclosure Management Jun 17, 2026 Jan 14, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting.
CVE-2020-5193 1Phpgurukul 1Hospital Management System Jun 17, 2026 Jan 14, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple reflected XSS vulnerabilities via the searchdata or Doctorspecialization parameter.
CVE-2020-5853 1F5 1Big Ip Access Policy Manager Jun 17, 2026 Jan 14, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In BIG-IP APM portal access on versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, when backend servers serve HTTP pages with special JavaScript code, this can lead to internal p...Show more In BIG-IP APM portal access on versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, when backend servers serve HTTP pages with special JavaScript code, this can lead to internal portal access name conflict.Show less
CVE-2019-12398 1Apache 1Airflow Jun 17, 2026 Jan 14, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "...Show more In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.Show less
CVE-2014-9211 1Clickdesk 1Clickdesk Nov 21, 2024 Jan 14, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ClickDesk version 4.3 and below has persistent cross site scripting
CVE-2020-6955 1Cayintech 1Smp Pro4 Firmware Jun 17, 2026 Jan 13, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered on Cayin SMP-PRO4 devices. They allow image_preview.html?filename= reflected XSS.
CVE-2020-5195 1Cerberusftp 1Ftp Server Jun 17, 2026 Jan 13, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remote attacker to execute arbitrary JavaScript or HTML via a crafted public folder URL. This occurs because of th...Show more Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remote attacker to execute arbitrary JavaScript or HTML via a crafted public folder URL. This occurs because of the folder_up.png IMG element not properly sanitizing user-inserted directory paths. The path modification must be done on a publicly shared folder for a remote attacker to insert arbitrary JavaScript or HTML. The vulnerability impacts anyone who clicks the malicious link crafted by the attacker.Show less
CVE-2019-20212 1Cththemes 3Citybook EasybookTownhub Jun 17, 2026 Jan 13, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat widget/page message form.
CVE-2019-20211 1Cththemes 3Citybook EasybookTownhub Jun 17, 2026 Jan 13, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing Address, Listing Latitude, Listing Longitude, Email Address, Description, Name, J...Show more The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing Address, Listing Latitude, Listing Longitude, Email Address, Description, Name, Job or Position, Description, Service Name, Address, Latitude, Longitude, Phone Number, or Website.Show less
CVE-2019-20210 1Cththemes 3Citybook EasybookTownhub Jun 17, 2026 Jan 13, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query.
CVE-2019-20209 1Cththemes 3Citybook EasybookTownhub Jun 17, 2026 Jan 13, 2020 N/A· v4 7.5 HIGH· v3 6.4 MEDIUM· v2 The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference (IDOR) via wp-admin/admin-ajax.php to delete any page/post/listing.
CVE-2019-18893 3Avas!t AvgVideo Downloader Project 3Secure Browser Secure BrowserVideo Downloader Jun 17, 2026 Jan 13, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is...Show more XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges and can for example access cookies and browsing history, spy on the user while they are surfing the web, and alter their surfing experience in almost arbitrary ways.Show less
CVE-2019-19547 2Fedoraproject Symantec 2Endpoint Detection And Response Fedora Jun 17, 2026 Jan 13, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Symantec Endpoint Detection and Response (SEDR), prior to 4.3.0, may be susceptible to a cross site scripting (XSS) issue. XSS is a type of issue that can enable attackers to inject client-side scripts into web pages vie...Show more Symantec Endpoint Detection and Response (SEDR), prior to 4.3.0, may be susceptible to a cross site scripting (XSS) issue. XSS is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. An XSS vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.Show less
CVE-2011-2670 1Mozilla 1Firefox Nov 21, 2024 Jan 13, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Mozilla Firefox before 3.6 is vulnerable to XSS via the rendering of Cascading Style Sheets

Previous 1...179017911792...2431 Next