Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,706)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2010-4245 1Translatehouse 1Pootle Nov 21, 2024 Oct 28, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 pootle 2.0.5 has XSS via 'match_names' parameter
CVE-2010-4240 1Tiki 1Tikiwiki Cms/groupware Nov 21, 2024 Oct 28, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Tiki Wiki CMS Groupware 5.2 has XSS
CVE-2009-4900 1Pixelpost 1Pixelpost Nov 21, 2024 Oct 28, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 pixelpost 1.7.1 has XSS
CVE-2019-14928 2Inea Mitsubishielectric 2Me Rtu Firmware Smartrtu Firmware Jun 17, 2026 Oct 28, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A number of stored cross-site script (XSS) vulnerabilities allow an attacker to inject malicious...Show more An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A number of stored cross-site script (XSS) vulnerabilities allow an attacker to inject malicious code directly into the application. An example input variable vulnerable to stored XSS is SerialInitialModemString in the index.php page.Show less
CVE-2019-18221 1Corehr 1Core Portal Jun 17, 2026 Oct 25, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 CoreHR Core Portal before 27.0.7 allows stored XSS.
CVE-2019-8085 1Adobe 1Experience Manager Jun 17, 2026 Oct 25, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2019-8084 1Adobe 1Experience Manager Jun 17, 2026 Oct 25, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2019-8083 1Adobe 1Experience Manager Jun 17, 2026 Oct 25, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Adobe Experience Manager versions 6.5, 6.4 and 6.3 have a cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2019-18419 1Clonos 1Clonos Jun 17, 2026 Oct 24, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
CVE-2019-8080 1Adobe 1Experience Manager Jun 17, 2026 Oct 24, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability. Successful exploitation could lead to privilege escalation.
CVE-2019-8079 1Adobe 1Experience Manager Jun 17, 2026 Oct 24, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2019-8078 1Adobe 1Experience Manager Jun 17, 2026 Oct 24, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2019-18416 1Restaurant Management System Project 1Restaurant Management System Jun 17, 2026 Oct 24, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Sourcecodester Restaurant Management System 1.0 allows XSS via the Last Name field of a member.
CVE-2019-18415 1Restaurant Management System Project 1Restaurant Management System Jun 17, 2026 Oct 24, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Sourcecodester Restaurant Management System 1.0 allows XSS via the "send a message" screen.
CVE-2019-18413 1Typestack Class Validator Project 1Typestack Class Validator Jun 17, 2026 Oct 24, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues paramet...Show more In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input. NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product.Show less
CVE-2019-12095 1Horde 1Groupware Jun 17, 2026 Oct 24, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags co...Show more Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could, for example, be a stored XSS payload.Show less
CVE-2019-12094 1Horde 1Groupware Jun 17, 2026 Oct 24, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=update_f&user_name= or admin/user.php?form=remove_f&user_name= or admin/config/diff.php?app= URI.
CVE-2019-17581 1Dormsystem Project 1Dormsystem Jun 17, 2026 Oct 24, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 tonyy dormsystem through 1.3 allows DOM XSS.
CVE-2019-4486 1Ibm 9Maximo Asset Management Maximo For AviationMaximo For Life Sciences+6 more Jun 17, 2026 Oct 24, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cred...Show more IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164070.Show less
CVE-2019-4459 1Ibm 1Cloud Orchestrator Jun 17, 2026 Oct 24, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We...Show more IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163656.Show less

Previous 1...181918201821...2436 Next