Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,714)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-16172 1Limesurvey 1Limesurvey Jun 17, 2026 Sep 9, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled u...Show more LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion.Show less
CVE-2019-11548 1Gitlab 1Gitlab Jun 17, 2026 Sep 9, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able to post comments on confidential issues through an authorizati...Show more An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able to post comments on confidential issues through an authorization issue in the note endpoint.Show less
CVE-2019-11547 1Gitlab 1Gitlab Jun 17, 2026 Sep 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has Improper Encoding or Escaping of Output. The branch name on new merge request no...Show more An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has Improper Encoding or Escaping of Output. The branch name on new merge request notification emails isn't escaped, which could potentially lead to XSS issues.Show less
CVE-2019-5471 1Gitlab 1Gitlab Jun 17, 2026 Sep 9, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSS. This was addressed in GitLab 12.1.2, 12.0.4, and 11.11.6.
CVE-2019-5467 1Gitlab 1Gitlab Jun 17, 2026 Sep 9, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. This vulnerability was addressed in 12.1.2, 12.0.4, and 11.11.6.
CVE-2019-10670 1Librenms 1Librenms Jun 17, 2026 Sep 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in LibreNMS through 1.47. Many of the scripts rely on the function mysqli_escape_real_string for filtering data. However, this is particularly ineffective when returning user supplied input in an...Show more An issue was discovered in LibreNMS through 1.47. Many of the scripts rely on the function mysqli_escape_real_string for filtering data. However, this is particularly ineffective when returning user supplied input in an HTML or a JavaScript context, resulting in unsafe data being injected into these contexts, leading to attacker controlled JavaScript executing in the browser. One example of this is the string parameter in html/pages/inventory.inc.php.Show less
CVE-2019-16148 1Sakailms 1Sakai Jun 17, 2026 Sep 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Sakai through 12.6 allows XSS via a chat user name.
CVE-2019-16146 1Getgophish 1Gophish Jun 17, 2026 Sep 9, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Gophish through 0.8.0 allows XSS via a username.
CVE-2018-21014 1Buddyboss 1Buddymoss Media Nov 21, 2024 Sep 9, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS.
CVE-2018-21012 1Vsourz 1Cf7 Invisible Recaptcha Nov 21, 2024 Sep 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS.
CVE-2019-16130 1Hgw168cc 1Yii Cms Jun 17, 2026 Sep 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html.
CVE-2019-16126 1Getgrav 1Grav Cms Jun 17, 2026 Sep 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images.
CVE-2019-16118 110web 1Photo Gallery Jun 17, 2026 Sep 8, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.
CVE-2019-16117 110web 1Photo Gallery Jun 17, 2026 Sep 8, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.
CVE-2019-16104 1Silver Peak 1Unity Edgeconnect Sd Wan Firmware Jun 17, 2026 Sep 8, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Silver Peak EdgeConnect SD-WAN before 8.1.7.x has reflected XSS via the rest/json/configdb/download/ PATH_INFO.
CVE-2018-11198 1Acquia 1Mautic Nov 21, 2024 Sep 6, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Mautic 2.13.1. There is Stored XSS via the authorUrl field in config.json.
CVE-2019-15848 1Jetbrains 1Teamcity Jun 17, 2026 Sep 5, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arbitrary HTTP request to a TeamCity server under the name of the currently logged-in user.
CVE-2019-4186 1Ibm 1Jazz For Service Management Jun 17, 2026 Sep 5, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header during caching. By sending a specially crafted HTTP GET request, a remote attacker could exp...Show more IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header during caching. By sending a specially crafted HTTP GET request, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-force ID: 158976.Show less
CVE-2019-4149 1Ibm 2Business Automation Workflow Business Process Manager Jun 17, 2026 Sep 5, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06, and V8.5.6.0 through V8.5....Show more IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06, and V8.5.6.0 through V8.5.6.0 CF2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158415.Show less
CVE-2019-10677 1Dasanzhone 1Znid Gpon 2426a Eu Firmware Jun 17, 2026 Sep 5, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple Cross-Site Scripting (XSS) issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devices allow a remote attacker to execute arbitrary JavaScript via manipulation of an unsanitized GET pa...Show more Multiple Cross-Site Scripting (XSS) issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devices allow a remote attacker to execute arbitrary JavaScript via manipulation of an unsanitized GET parameter: /zhndnsdisplay.cmd (name), /wlsecrefresh.wl (wlWscCfgMethod, wl_wsc_reg).Show less

Previous 1...184118421843...2436 Next