Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,712)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-17070 1Lqd 1Liquid Speech Balloon Jun 17, 2026 Oct 10, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer.
CVE-2019-17427 1Redmine 1Redmine Jun 17, 2026 Oct 10, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors.
CVE-2019-17417 1Pbootcms 1Pbootcms Jun 17, 2026 Oct 10, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs.
CVE-2019-0047 1Juniper 1Junos Jun 17, 2026 Oct 9, 2019 N/A· v4 8.8 HIGH· v3 4.3 MEDIUM· v2 A persistent Cross-Site Scripting (XSS) vulnerability in Junos OS J-Web interface may allow remote unauthenticated attackers to perform administrative actions on the Junos device. Successful exploitation requires a Junos...Show more A persistent Cross-Site Scripting (XSS) vulnerability in Junos OS J-Web interface may allow remote unauthenticated attackers to perform administrative actions on the Junos device. Successful exploitation requires a Junos administrator to first perform certain diagnostic actions on J-Web. This issue affects: Juniper Networks Junos OS 12.1X46 versions prior to 12.1X46-D86; 12.3 versions prior to 12.3R12-S13; 12.3X48 versions prior to 12.3X48-D80; 14.1X53 versions prior to 14.1X53-D51; 15.1 versions prior to 15.1F6-S13, 15.1R7-S4; 15.1X49 versions prior to 15.1X49-D171, 15.1X49-D180; 15.1X53 versions prior to 15.1X53-D497, 15.1X53-D69; 16.1 versions prior to 16.1R7-S5; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R2-S7, 17.2R3-S1; 17.3 versions prior to 17.3R3-S6; 17.4 versions prior to 17.4R1-S7, 17.4R2-S4, 17.4R3; 18.1 versions prior to 18.1R3-S5; 18.2 versions prior to 18.2R1-S5, 18.2R2-S3, 18.2R3; 18.3 versions prior to 18.3R1-S3, 18.3R2, 18.3R3; 18.4 versions prior to 18.4R1-S2, 18.4R2.Show less
CVE-2019-17092 1Openproject 1Openproject Jun 17, 2026 Oct 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter because error messages are mishandled.
CVE-2019-17385 1Eleopard 1Animate It! Jun 17, 2026 Oct 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The animate-it plugin before 2.3.5 for WordPress has XSS.
CVE-2019-17384 1Eleopard 1Animate It! Jun 17, 2026 Oct 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The animate-it plugin before 2.3.4 for WordPress has XSS.
CVE-2019-17380 1Cpanel 1Cpanel Jun 17, 2026 Oct 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528).
CVE-2019-17379 1Cpanel 1Cpanel Jun 17, 2026 Oct 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527).
CVE-2019-17378 1Cpanel 1Cpanel Jun 17, 2026 Oct 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526).
CVE-2019-17377 1Cpanel 1Cpanel Jun 17, 2026 Oct 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524).
CVE-2019-17376 1Cpanel 1Cpanel Jun 17, 2026 Oct 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521).
CVE-2019-11212 1Tibco 1Master Data Management Jun 17, 2026 Oct 9, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The MDM server component of TIBCO Software Inc's TIBCO MDM contains multiple vulnerabilities that theoretically allow an authenticated user with specific roles to perform cross-site scripting (XSS) attacks. This issue af...Show more The MDM server component of TIBCO Software Inc's TIBCO MDM contains multiple vulnerabilities that theoretically allow an authenticated user with specific roles to perform cross-site scripting (XSS) attacks. This issue affects TIBCO Software Inc.'s TIBCO MDM version 9.0.1 and prior versions; version 9.1.0.Show less
CVE-2019-17368 1S Cms 1S Cms Jun 17, 2026 Oct 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter.
CVE-2019-0378 1Sap 1Businessobjects Business Intelligence Platform Jun 17, 2026 Oct 8, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the file...Show more SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the file name of the background image resulting in Stored Cross-Site Scripting.Show less
CVE-2019-0377 1Sap 1Businessobjects Business Intelligence Platform Jun 17, 2026 Oct 8, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the inpu...Show more SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the input controls, resulting in Stored Cross-Site Scripting.Show less
CVE-2019-0376 1Sap 1Businessobjects Business Intelligence Platform Jun 17, 2026 Oct 8, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows an attacker to save malicious scripts in t...Show more SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows an attacker to save malicious scripts in the publication name, which can be executed later by the victim, resulting in Stored Cross-Site Scripting.Show less
CVE-2019-0375 1Sap 1Businessobjects Business Intelligence Platform Jun 17, 2026 Oct 8, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the export dialog...Show more SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the export dialog box of the report name resulting in reflected Cross-Site Scripting.Show less
CVE-2019-0374 1Sap 1Businessobjects Business Intelligence Platform Jun 17, 2026 Oct 8, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the chart title re...Show more SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs and allows execution of scripts in the chart title resulting in reflected Cross-Site ScriptingShow less
CVE-2019-0369 1Sap 1Financial Consolidation Jun 17, 2026 Oct 8, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SAP Financial Consolidation, before versions 10.0 and 10.1, does not sufficiently encode user-controlled inputs, which allows an attacker to execute scripts by uploading files containing malicious scripts, leading to ref...Show more SAP Financial Consolidation, before versions 10.0 and 10.1, does not sufficiently encode user-controlled inputs, which allows an attacker to execute scripts by uploading files containing malicious scripts, leading to reflected cross site scripting vulnerability.Show less

Previous 1...182818291830...2436 Next