← Back
CWE-79

48,714 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,714)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-14996
1Atlassian
1Jira Server
Jun 17, 2026
Sep 11, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The FilterPickerPopup.jspa resource in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability...Show more
The FilterPickerPopup.jspa resource in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.Show less
CVE-2019-16193
1Esri
1Arcgis Enterprise
Jun 17, 2026
Sep 11, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting (XFS) attack through the EDIT MY PROFILE feature.
CVE-2019-11464
1Couchbase
1Couchbase Server
Jun 17, 2026
Sep 10, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options are generally advisable, however some information security p...Show more
Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options are generally advisable, however some information security professionals additionally look for X-Permitted-Cross-Domain-Policies and X-XSS-Protection, which are more generally applicable to HTML endpoint, to be included too. These headers were not included in Couchbase Server 5.5.0 and 5.1.2 . They are now included in version 6.0.2 in responses from the Couchbase Server Views REST API (port 8092).Show less
CVE-2019-0361
1Sap
1Supplier Relationship Management
Jun 17, 2026
Sep 10, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabi...Show more
SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.Show less
CVE-2017-18611
1Magicfields
1Magic Fields
Nov 21, 2024
Sep 10, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter.
CVE-2017-18610
1Magicfields
1Magic Fields
Nov 21, 2024
Sep 10, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter.
CVE-2017-18609
1Magicfields
1Magic Fields
Nov 21, 2024
Sep 10, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.
CVE-2017-18608
1Spot
1Spot.im Comments
Nov 21, 2024
Sep 10, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.
CVE-2017-18606
1Theme Fusion
1Avada
Nov 21, 2024
Sep 10, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The avada theme before 5.1.5 for WordPress has stored XSS.
CVE-2017-18603
1Postman Smtp Project
1Postman Smtp
Nov 21, 2024
Sep 10, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter.
CVE-2017-18601
1Ibps Online Exam Project
1Ibps Online Exam
Nov 21, 2024
Sep 10, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The examapp plugin 1.0 for WordPress has XSS via exam input text fields.
CVE-2017-18600
1Ncrafts
1Formcraft
Nov 21, 2024
Sep 10, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.
CVE-2017-18599
1Pinfinity Project
1Pinfinity
Nov 21, 2024
Sep 10, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter.
CVE-2017-18598
1Designmodo
1Qards
Nov 21, 2024
Sep 10, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php.
CVE-2019-16182
1Limesurvey
1Limesurvey
Jun 17, 2026
Sep 9, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitrary web script or HTML via extensions of uploaded files.
CVE-2019-16178
1Limesurvey
1Limesurvey
Jun 17, 2026
Sep 9, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A stored cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on...Show more
A stored cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page.Show less
CVE-2019-16147
1Liferay
1Liferay Portal
Jun 17, 2026
Sep 9, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib.
CVE-2019-16145
1Padrinorb
1Padrino Contrib
Jun 17, 2026
Sep 9, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.
CVE-2019-6784
1Gitlab
1Gitlab
Jun 17, 2026
Sep 9, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 1 of 2). Markdown fields contain a lack of input validation and outpu...Show more
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 1 of 2). Markdown fields contain a lack of input validation and output encoding when processing KaTeX that results in a persistent XSS.Show less
CVE-2019-16173
1Limesurvey
1Limesurvey
Jun 17, 2026
Sep 9, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in application/core/Survey_Common_Action.php,