← Back
CWE-79

48,617 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,617)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-5843
1Codologic
1Codoforum
Jun 17, 2026
Jan 7, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen.
CVE-2014-9405
1Free
1Freebox Os
Nov 21, 2024
Jan 6, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A Cross-Site Scripting (XSS) vulnerability exists in the description field of an Download RSS item or Contacts in Freebox OS Web interface 3.0.2, which allows malicious users to execute arbitrary code.
CVE-2014-8674
1Soplanning
1Soplanning
Nov 21, 2024
Jan 6, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb_ligness and the debug GET parameter to export.php, which allows malic...Show more
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb_ligness and the debug GET parameter to export.php, which allows malicious users to execute arbitrary code.Show less
CVE-2019-18842
1Usriot
4Usr Wifi232 G2 Firmware
Usr Wifi232 H FirmwareUsr Wifi232 S Firmware+1 more
Jun 17, 2026
Jan 6, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A cross-site scripting (XSS) vulnerability in the configuration web interface of the Jinan USR IOT USR-WIFI232-S/T/G2/H Low Power WiFi Module with web version 1.2.2 allows attackers to leak credentials of the Wi-Fi acces...Show more
A cross-site scripting (XSS) vulnerability in the configuration web interface of the Jinan USR IOT USR-WIFI232-S/T/G2/H Low Power WiFi Module with web version 1.2.2 allows attackers to leak credentials of the Wi-Fi access point the module is logged into, and the web interface login credentials, by opening a Wi-Fi access point nearby with a malicious SSID.Show less
CVE-2019-16717
1Open Xchange
1Open Xchange Appsuite
Jun 17, 2026
Jan 6, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
OX App Suite through 7.10.2 has XSS.
CVE-2014-3743
1Marked Project
1Marked
Nov 21, 2024
Jan 6, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2)...Show more
Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's.Show less
CVE-2015-4039
1E Plugins
1Wp Membership
Nov 21, 2024
Jan 6, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified (1) profile fields or (2) new po...Show more
Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified (1) profile fields or (2) new post content. NOTE: CVE-2015-4038 can be used to bypass the administrator confirmation step for vector 2.Show less
CVE-2019-15603
1Seeftl Project
1Seeftl
Jun 17, 2026
Jan 6, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a directory listing.
CVE-2019-15602
1Itwork
1Fileview
Jun 17, 2026
Jan 6, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability in files it serves.
CVE-2019-5989
1Anglers Net
1Cgi An Anlyzer
Jun 17, 2026
Jan 6, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
DOM-based cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to inject arbitrary web script or HTML via the Analysis Object Page.
CVE-2019-5988
1Anglers Net
1Cgi An Anlyzer
Jun 17, 2026
Jan 6, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Stored cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to inject arbitrary web script or HTML via the Management Page.
CVE-2020-5191
1Phpgurukul
1Hospital Management System
Jun 17, 2026
Jan 6, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple Persistent XSS vulnerabilities.
CVE-2019-19265
1Icewarp
1Mail Server
Jun 17, 2026
Jan 6, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts.
CVE-2019-19266
1Icewarp
1Mail Server
Jun 17, 2026
Jan 6, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 2 of 2) in notes for objects.
CVE-2020-5306
1Codologic
1Codoforum
Jun 17, 2026
Jan 5, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content.
CVE-2020-5305
1Codologic
1Codoforum
Jun 17, 2026
Jan 5, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen.
CVE-2019-20154
1Determine
1Contract Lifecycle Management
Jun 17, 2026
Jan 5, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) v5.4. A cross-site scripting (XSS) vulnerability in multiple getchart.jsp parameters allows remote attackers to inject arbitra...Show more
An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) v5.4. A cross-site scripting (XSS) vulnerability in multiple getchart.jsp parameters allows remote attackers to inject arbitrary web script or HTML.Show less
CVE-2019-20336
1Advanced Real Estate Script Project
1Advanced Real Estate Script
Jun 17, 2026
Jan 5, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In PHP Scripts Mall advanced-real-estate-script 4.0.9, the search-results.php searchtext parameter is vulnerable to XSS.
CVE-2020-5497
1Mitreid
1Connect
Jun 17, 2026
Jan 4, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute ar...Show more
The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript.Show less
CVE-2019-9542
1Telos
1Automated Message Handling System
Jun 17, 2026
Jan 3, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in itemlookup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into a...Show more
: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in itemlookup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an AMHS session. This issue affects: Telos Automated Message Handling System versions prior to 4.1.5.5.Show less