Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (46,037)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-10680 1Zblogcn 1Z Blogphp Nov 21, 2024 May 2, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zb_system/cmd.php...Show more Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zb_system/cmd.php ZC_BLOG_NAME parameter. NOTE: the vendor disputes the security relevance, noting it is "just a functional bug.Show less
CVE-2018-10665 1Ilias 1Ilias Nov 21, 2024 May 2, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ILIAS 5.3.4 has XSS through unsanitized output of PHP_SELF, related to shib_logout.php and third-party demo files.
CVE-2018-10259 1Hrsale Project 1Hrsale Nov 21, 2024 May 1, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An Authenticated Stored XSS vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user.
CVE-2017-5536 1Tibco 1Datasynapse Gridserver Manager Nov 21, 2024 May 1, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The GridServer Broker, and GridServer Director components of TIBCO Software Inc. TIBCO DataSynapse GridServer Manager contain vulnerabilities which may allow an authenticated user to perform cross-site scripting (XSS). I...Show more The GridServer Broker, and GridServer Director components of TIBCO Software Inc. TIBCO DataSynapse GridServer Manager contain vulnerabilities which may allow an authenticated user to perform cross-site scripting (XSS). In addition, an authenticated user could be a victim of a cross-site request forgery (CSRF) attack. Affected releases include TIBCO Software Inc.'s TIBCO DataSynapse GridServer Manager: versions up to and including 5.1.3; 6.0.0; 6.0.1; 6.0.2; 6.1.0; 6.1.1; and 6.2.0.Show less
CVE-2018-10365 1Threads To Link Project 1Threads To Link Nov 21, 2024 May 1, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An XSS issue was discovered in the Threads to Link plugin 1.3 for MyBB. When editing a thread, the user is given the option to convert the thread to a link. The thread link input box is not properly sanitized.
CVE-2018-1502 1Ibm 1Content Manager Nov 21, 2024 May 1, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Content Manager Enterprise Edition Resource Manager 8.4.3 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended fun...Show more IBM Content Manager Enterprise Edition Resource Manager 8.4.3 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 141338.Show less
CVE-2018-10371 1Wunderfarm 1Wf Cookie Consent Nov 21, 2024 May 1, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in the wunderfarm WF Cookie Consent plugin 1.1.3 for WordPress. A persistent cross-site scripting vulnerability has been identified in the web interface of the plugin that allows the execution of...Show more An issue was discovered in the wunderfarm WF Cookie Consent plugin 1.1.3 for WordPress. A persistent cross-site scripting vulnerability has been identified in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in a victim's web browser via a page title.Show less
CVE-2018-1000172 1Imagely 1Nextgen Gallery Nov 21, 2024 Apr 30, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text. This attack appears to be exploitable via a victim viewing the image in the administrator...Show more Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text. This attack appears to be exploitable via a victim viewing the image in the administrator page. This vulnerability appears to have been fixed in 2.2.45.Show less
CVE-2018-10364 1Bigtreecms 1Bigtree Cms Nov 21, 2024 Apr 30, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 BigTree before 4.2.22 has XSS in the Users management page via the name or company field.
CVE-2018-10571 1Open Emr 1Openemr Nov 21, 2024 Apr 30, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple reflected cross-site scripting (XSS) vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) patient parameter to interface/main/finder/finder_navigation...Show more Multiple reflected cross-site scripting (XSS) vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) patient parameter to interface/main/finder/finder_navigation.php; (2) key parameter to interface/billing/get_claim_file.php; (3) formid or (4) formseq parameter to interface/orders/types.php; (5) eraname, (6) paydate, (7) post_to_date, (8) deposit_date, (9) debug, or (10) InsId parameter to interface/billing/sl_eob_process.php; (11) form_source, (12) form_paydate, (13) form_deposit_date, (14) form_amount, (15) form_name, (16) form_pid, (17) form_encounter, (18) form_date, or (19) form_to_date parameter to interface/billing/sl_eob_search.php; (20) codetype or (21) search_term parameter to interface/de_identification_forms/find_code_popup.php; (22) search_term parameter to interface/de_identification_forms/find_drug_popup.php; (23) search_term parameter to interface/de_identification_forms/find_immunization_popup.php; (24) id parameter to interface/forms/CAMOS/view.php; (25) id parameter to interface/forms/reviewofs/view.php; or (26) list_id parameter to library/custom_template/personalize.php.Show less
CVE-2018-10570 1Frogcms Project 1Frogcms Nov 21, 2024 Apr 30, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Frog CMS 0.9.5 has XSS in /install/index.php via the ['config']['admin_username'] field.
CVE-2018-1430 1Ibm 1Api Connect Nov 21, 2024 Apr 30, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM API Connect 5.0.0.0 through 5.0.8.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading...Show more IBM API Connect 5.0.0.0 through 5.0.8.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 139226.Show less
CVE-2018-0711 1Qnap 1Qts Nov 21, 2024 Apr 30, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML.
CVE-2018-10554 1Nagios 1Nagios Xi Nov 21, 2024 Apr 30, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in Nagios XI 5.4.13. There is XSS exploitable via CSRF in (1) the Schedule New Report screen via the hour, minute, or ampm parameter, related to components/scheduledreporting; (2) includes/compone...Show more An issue was discovered in Nagios XI 5.4.13. There is XSS exploitable via CSRF in (1) the Schedule New Report screen via the hour, minute, or ampm parameter, related to components/scheduledreporting; (2) includes/components/xicore/downtime.php, related to the update_pages function; (3) the ajaxhelper.php opts or background parameter; (4) the i[] array parameter to ajax_handler.php; or (5) the deploynotification.php title parameter.Show less
CVE-2018-10547 4Canonical DebianNetapp+1 more 4Debian Linux PhpStorage Automation Store+1 more Nov 21, 2024 Apr 29, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a r...Show more An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712.Show less
CVE-2018-10527 1Easycms Project 1Easycms Nov 21, 2024 Apr 28, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.html#listarticle URI.
CVE-2018-1473 1Ibm 1Bigfix Platform Nov 21, 2024 Apr 27, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cred...Show more IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 140691.Show less
CVE-2018-7465 1Virtuemart 1Virtuemart Jun 17, 2026 Apr 26, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed by simply adding </textarea> to the value and saving the product/config. By editing back the product/c...Show more An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed by simply adding </textarea> to the value and saving the product/config. By editing back the product/config, the editor's browser will execute everything after the </textarea>, leading to a possible XSS.Show less
CVE-2018-10430 1Dilicms 1Dilicms Nov 21, 2024 Apr 26, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in DiliCMS (aka DiligentCMS) 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting->site setting" of admin/index.php.
CVE-2017-9275 1Netiq 1Identity Reporting Nov 21, 2024 Apr 26, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 NetIQ Identity Reporting, in versions prior to 5.5 Service Pack 1, is susceptible to an XSS attack.

Previous 1...185018511852...2302 Next