Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,606)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-19547 2Fedoraproject Symantec 2Endpoint Detection And Response Fedora Jun 17, 2026 Jan 13, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Symantec Endpoint Detection and Response (SEDR), prior to 4.3.0, may be susceptible to a cross site scripting (XSS) issue. XSS is a type of issue that can enable attackers to inject client-side scripts into web pages vie...Show more Symantec Endpoint Detection and Response (SEDR), prior to 4.3.0, may be susceptible to a cross site scripting (XSS) issue. XSS is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. An XSS vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.Show less
CVE-2011-2670 1Mozilla 1Firefox Nov 21, 2024 Jan 13, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Mozilla Firefox before 3.6 is vulnerable to XSS via the rendering of Cascading Style Sheets
CVE-2020-6848 1Axper 1Vision Ii Firmware Jun 17, 2026 Jan 13, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Axper Vision II 4 devices allow XSS via the DEVICE_NAME (aka Device Name) parameter to the configWebParams.cgi URI.
CVE-2020-6847 1Opentrade Project 1Opentrade Jun 17, 2026 Jan 11, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 OpenTrade through 0.2.0 has a DOM-based XSS vulnerability that is executed when an administrator attempts to delete a message that contains JavaScript.
CVE-2019-20377 1Tophub 1Toplist Jun 17, 2026 Jan 11, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 TopList before 2019-09-03 allows XSS via a title.
CVE-2019-20379 1Ganglia 1Ganglia Web Jun 17, 2026 Jan 11, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php cs parameter.
CVE-2019-20378 1Ganglia 1Ganglia Web Jun 17, 2026 Jan 11, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php ce parameter.
CVE-2019-18588 1Dell 2Emc Powermax Emc Unisphere For Powermax Jun 17, 2026 Jan 10, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMax OS 5978.221.221 and 5978.479.479 contain a Cross-Site Scripting (XSS) vulnerabi...Show more Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMax OS 5978.221.221 and 5978.479.479 contain a Cross-Site Scripting (XSS) vulnerability. An authenticated malicious user may potentially exploit this vulnerability to inject javascript code and affect other authenticated users' sessions.Show less
CVE-2020-1766 2Debian Otrs 2Debian Linux Otrs Jun 17, 2026 Jan 10, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. Thi...Show more Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and prior versions; 6.0.x version 6.0.24 and prior versions. OTRS 7.0.x version 7.0.13 and prior versions.Show less
CVE-2014-4561 1Ultimate Weather Project 1Ultimate Weather Nov 21, 2024 Jan 10, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The ultimate-weather plugin 1.0 for WordPress has XSS
CVE-2013-6430 1Pivotal Software 1Spring Framework Nov 21, 2024 Jan 10, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site...Show more The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.Show less
CVE-2011-4595 1Caseproof 1Prettylinks Feb 13, 2025 Jan 10, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Pretty-Link WordPress plugin 1.5.2 has XSS
CVE-2014-4530 1Flog Project 1Flog Nov 21, 2024 Jan 10, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 flog plugin 0.1 for WordPress has XSS
CVE-2019-20376 1Psi 1Electronic Logbook Jun 17, 2026 Jan 10, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG document to elogd.c.
CVE-2019-20375 1Psi 1Electronic Logbook Jun 17, 2026 Jan 10, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via the value parameter in a localization (loc) command to elogd.c.
CVE-2020-6758 1Rasilient 1Pixelstor 5000 Firmware Jun 17, 2026 Jan 9, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability in Option/optionsAll.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows remote attackers to inject arbitrary web script or HTML via the ContentFrame parame...Show more A cross-site scripting (XSS) vulnerability in Option/optionsAll.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows remote attackers to inject arbitrary web script or HTML via the ContentFrame parameter.Show less
CVE-2019-20374 1Typora 1Typora Jun 17, 2026 Jan 9, 2020 N/A· v4 9.6 CRITICAL· v3 6.8 MEDIUM· v2 A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a fil...Show more A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment.Show less
CVE-2019-20182 1Fooplugins 1Foogallery Jun 17, 2026 Jan 9, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter.
CVE-2019-20181 1Getawesomesupport 1Awesome Support Jun 17, 2026 Jan 9, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter.
CVE-2019-18859 1Digi 1Anywhereusb/14 Firmware Jun 17, 2026 Jan 9, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Digi AnywhereUSB 14 allows XSS via a link for the Digi Page.

Previous 1...179117921793...2431 Next