← Back
CWE-79

46,117 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (46,117)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-16736
1Rcfilters Project
1Rcfilters
Nov 21, 2024
Sep 9, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages parameters (in the Filters section of the settings).
CVE-2018-16730
1Chshcms
1Cscms
Nov 21, 2024
Sep 8, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name.
CVE-2018-16725
1Baijiacms Project
1Baijiacms
Nov 21, 2024
Sep 8, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue is discovered in baijiacms V4. XSS exists via the assets/weengine/components/zclip/ZeroClipboard.swf id parameter, aka "Non-standard use of the flash component."
CVE-2018-9283
1Cremecrm
1Cremecrm
Jun 17, 2026
Sep 7, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An XSS issue was discovered in CremeCRM 1.6.12. It is affected by 10 stored Cross-Site Scripting (XSS) vulnerabilities in the firstname, lastname, billing_address-address, billing_address-zipcode, billing_address-city, b...Show more
An XSS issue was discovered in CremeCRM 1.6.12. It is affected by 10 stored Cross-Site Scripting (XSS) vulnerabilities in the firstname, lastname, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department, shipping_address-address, shipping_address-zipcode, shipping_address-city, and shipping_address-department parameters in the contact creation and modification page. The payload is stored within the application database and allows the execution of JavaScript code each time a client visit an infected page.Show less
CVE-2018-16363
1Filemanagerpro
1File Manager
Nov 21, 2024
Sep 7, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of...Show more
The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php.Show less
CVE-2018-14397
1Cremecrm
1Cremecrm
Nov 21, 2024
Sep 7, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in Creme CRM 1.6.12. The organization creation page is affected by 9 stored cross-site scripting vulnerabilities involving the name, billing_address-address, billing_address-zipcode, billing_addre...Show more
An issue was discovered in Creme CRM 1.6.12. The organization creation page is affected by 9 stored cross-site scripting vulnerabilities involving the name, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department, shipping_address-address, shipping_address-zipcode, shipping_address-city, and shipping_address-department parameters.Show less
CVE-2018-14396
1Cremecrm
1Cremecrm
Nov 21, 2024
Sep 7, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in Creme CRM 1.6.12. The salesman creation page is affected by 10 stored cross-site scripting vulnerabilities involving the firstname, lastname, billing_address-address, billing_address-zipcode, b...Show more
An issue was discovered in Creme CRM 1.6.12. The salesman creation page is affected by 10 stored cross-site scripting vulnerabilities involving the firstname, lastname, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department, shipping_address-address, shipping_address-zipcode, shipping_address-city, and shipping_address-department parameters.Show less
CVE-2017-1114
1Ibm
1Campaign
Nov 21, 2024
Sep 7, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cred...Show more
IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 121152.Show less
CVE-2018-0657
2Ec Cube
Gmo Pg
2Ec Cube Payment Module
Gmo Pg Payment Module
Nov 21, 2024
Sep 7, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) versi...Show more
Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, and GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier) allow an attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors.Show less
CVE-2018-0655
1Weseek
1Growi
Nov 21, 2024
Sep 7, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page.
CVE-2018-0654
1Weseek
1Growi
Nov 21, 2024
Sep 7, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the modal for creating Wiki page.
CVE-2018-0653
1Weseek
1Growi
Nov 21, 2024
Sep 7, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via Wiki page view.
CVE-2018-0652
1Weseek
1Growi
Nov 21, 2024
Sep 7, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the UserGroup Management section of admin page.
CVE-2018-0642
1Foliovision
1Fv Flowplayer Video Player
Nov 21, 2024
Sep 7, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-16655
1Gxlcms
1Gxlcms
Nov 21, 2024
Sep 7, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php.
CVE-2018-16654
1Zurmo
1Zurmo Crm
Nov 21, 2024
Sep 7, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1.
CVE-2018-16653
1Rejucms Project
1Rejucms
Nov 21, 2024
Sep 7, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
rejucms 2.1 has XSS via the ucenter/cms_user_add.php u_name parameter.
CVE-2018-16285
1Userproplugin
1Userpro
Nov 21, 2024
Sep 6, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php.
CVE-2018-12234
1Myadrenalin
1Adrenalin
Mar 2, 2026
Sep 6, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4.0 HRMS Software. The user supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the flexiporta...Show more
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4.0 HRMS Software. The user supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the flexiportal/GeneralInfo.aspx strAction parameter.Show less
CVE-2018-5005
1Adobe
1Experience Manager
Nov 21, 2024
Sep 6, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a Cross-site Scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.