← Back
CWE-79

48,646 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,646)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2012-1114
3Debian
FedoraprojectLdap Account Manager
3Debian Linux
FedoraLdap Account Manager
Nov 21, 2024
Dec 5, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and exporter_id action. and the filteruid parameter to list.php.
CVE-2019-16769
1Verizon
1Serialize Javascript
Jun 17, 2026
Dec 5, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not...Show more
The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.Show less
CVE-2019-7185
1Qnap
1Music Station
Jun 17, 2026
Dec 5, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Music Sta...Show more
This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Music Station to their latest versions.Show less
CVE-2019-7184
1Qnap
1Video Station
Jun 17, 2026
Dec 5, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Video Sta...Show more
This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Video Station to their latest versions.Show less
CVE-2019-19466
1Sceditor
1Sceditor
Jun 17, 2026
Dec 5, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
SCEditor 2.1.3 allows XSS.
CVE-2013-0283
1Theforeman
1Katello
Nov 21, 2024
Dec 5, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Katello: Username in Notification page has cross site scripting
CVE-2019-19596
1Gitbook
1Gitbook
Jun 17, 2026
Dec 5, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
GitBook through 2.6.9 allows XSS via a local .md file.
CVE-2019-19587
1Wso2
1Enterprise Integrator
Jun 17, 2026
Dec 5, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor configuration from the source view in the Management Console.
CVE-2019-19133
1Csshero
1Csshero
Jun 17, 2026
Dec 4, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this iss...Show more
The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary JavaScript in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookies or launch other attacks.Show less
CVE-2019-18347
1Davical
1Davical
Jun 17, 2026
Dec 4, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be e...Show more
A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users, making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username, Display Name, and Email.Show less
CVE-2019-7197
1Qnap
1Qts
Jun 17, 2026
Dec 4, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. T...Show more
A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version.Show less
CVE-2019-18574
2Emc
Rsa
2Authentication Manager
Rsa Authentication Manager
Jun 17, 2026
Dec 3, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
RSA Authentication Manager software versions prior to 8.4 P8 contain a stored cross-site scripting vulnerability in the Security Console. A malicious Security Console administrator could exploit this vulnerability to sto...Show more
RSA Authentication Manager software versions prior to 8.4 P8 contain a stored cross-site scripting vulnerability in the Security Console. A malicious Security Console administrator could exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface which could then be included in a report. When other Security Console administrators open the affected report, the injected scripts could potentially be executed in their browser.Show less
CVE-2019-19457
1Saltosystem
1Proaccess Space
Jun 17, 2026
Dec 3, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
SALTO ProAccess SPACE 5.4.3.0 allows XSS.
CVE-2019-18993
1Openwrt
1Openwrt
Jun 17, 2026
Dec 3, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
OpenWrt 18.06.4 allows XSS via the "New port forward" Name field to the cgi-bin/luci/admin/network/firewall/forwards URI (this can occur, for example, on a TP-Link Archer C7 device).
CVE-2019-18992
1Openwrt
1Openwrt
Jun 17, 2026
Dec 3, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
OpenWrt 18.06.4 allows XSS via these Name fields to the cgi-bin/luci/admin/network/firewall/rules URI: "Open ports on router" and "New forward rule" and "New Source NAT" (this can occur, for example, on a TP-Link Archer...Show more
OpenWrt 18.06.4 allows XSS via these Name fields to the cgi-bin/luci/admin/network/firewall/rules URI: "Open ports on router" and "New forward rule" and "New Source NAT" (this can occur, for example, on a TP-Link Archer C7 device).Show less
CVE-2019-4468
1Ibm
1Cloud Pak System
Jun 17, 2026
Dec 3, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...Show more
IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163777.Show less
CVE-2019-4467
1Ibm
1Cloud Pak System
Jun 17, 2026
Dec 3, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...Show more
IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163776.Show less
CVE-2019-4226
1Ibm
1Cloud Pak System
Jun 17, 2026
Dec 3, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...Show more
IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159243.Show less
CVE-2019-4098
1Ibm
1Cloud Pak System
Jun 17, 2026
Dec 3, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...Show more
IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158020.Show less
CVE-2013-2101
2Redhat
Theforeman
2Katello
Satellite
Nov 21, 2024
Dec 3, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Katello has multiple XSS issues in various entities