Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (46,037)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-9838 1Dolibarr 1Dolibarr Erp/crm Nov 21, 2024 Apr 11, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type paramete...Show more Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type parameter), holiday/list.php (month_create, month_start, and month_end parameters), and don/card.php (societe, lastname, firstname, address, zipcode, town, and email parameters).Show less
CVE-2017-18259 1Dolibarr 1Dolibarr Erp/crm Nov 21, 2024 Apr 11, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.
CVE-2018-9993 1Yunucms 1Yunucms Jun 17, 2026 Apr 10, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 YUNUCMS 1.0.7 has XSS via the content title on an admin/content/addcontent/cid/## page (aka a news center page).
CVE-2018-9985 1Metinfo 1Metinfo Jun 17, 2026 Apr 10, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator.
CVE-2018-8772 1Coship 1Rt3052 Firmware Jun 17, 2026 Apr 10, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Coship RT3052 4.0.0.48 devices allow XSS via a crafted SSID field on the "Wireless Setting - Basic" screen.
CVE-2018-2410 1Sap 1Business One Nov 21, 2024 Apr 10, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS) vulnerability.
CVE-2018-2405 1Sap 1Solution Manager Nov 21, 2024 Apr 10, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this could lead to possible Cross-Site Scripting.
CVE-2018-5227 1Atlassian 1Application Links Nov 21, 2024 Apr 10, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Various administrative application link resources in Atlassian Application Links before version 5.4.4 allow remote attackers with administration rights to inject arbitrary HTML or JavaScript via a cross site scripting (X...Show more Various administrative application link resources in Atlassian Application Links before version 5.4.4 allow remote attackers with administration rights to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the display url of a configured application link.Show less
CVE-2017-18100 1Atlassian 1Jira Nov 21, 2024 Apr 10, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of quick filters.
CVE-2018-9928 1Metinfo 1Metinfo Jun 17, 2026 Apr 10, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or weburl parameter.
CVE-2018-9925 1Icmsdev 1Icms Jun 17, 2026 Apr 10, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in idreamsoft iCMS through 7.0.7. XSS exists via the nickname field in an admincp.php?app=user&do=save&frame=iPHP request.
CVE-2018-6182 1Mahara 1Mahara Jun 17, 2026 Apr 9, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Mahara 16.10 before 16.10.9 and 17.04 before 17.04.7 and 17.10 before 17.10.4 are vulnerable to bad input when TinyMCE is bypassed by POST packages. Therefore, Mahara should not rely on TinyMCE's code stripping alone but...Show more Mahara 16.10 before 16.10.9 and 17.04 before 17.04.7 and 17.10 before 17.10.4 are vulnerable to bad input when TinyMCE is bypassed by POST packages. Therefore, Mahara should not rely on TinyMCE's code stripping alone but also clean input on the server / PHP side as one can create own packets of POST data containing bad content with which to hit the server.Show less
CVE-2018-9864 13cx 1Live Chat Jun 17, 2026 Apr 9, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field.
CVE-2018-9857 1Match Clone Script Project 1Match Clone Script Jun 17, 2026 Apr 9, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 PHP Scripts Mall Match Clone Script 1.0.4 has XSS via the search field to searchbyid.php (aka the "View Search By Id" screen).
CVE-2018-6905 1Typo3 1Typo3 Jun 17, 2026 Apr 8, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the installation process.
CVE-2018-9330 1Coremail 1Coremail Xt Jun 17, 2026 Apr 7, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 register.jsp in Coremail XT3.0 allows stored XSS, as demonstrated by the third form field to a URI under register/, a different vulnerability than CVE-2015-6942.
CVE-2018-9844 1Iptanus 1Wordpress File Upload Jun 17, 2026 Apr 7, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS.
CVE-2017-18098 1Atlassian 1Jira Nov 21, 2024 Apr 6, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The searchrequest-xml resource in Atlassian Jira before version 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through various fields.
CVE-2017-18097 1Atlassian 1Jira Nov 21, 2024 Apr 6, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers who can convince a Jira administrator to import their Trello board to inject arbitrary HTML or JavaScript via a cross site...Show more The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers who can convince a Jira administrator to import their Trello board to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the title of a Trello card.Show less
CVE-2018-9328 1Redbus Clone Script Project 1Redbus Clone Script Jun 17, 2026 Apr 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 PHP Scripts Mall Redbus Clone Script 3.0.6 has XSS via the ter_from or tag parameter to results.php.

Previous 1...185718581859...2302 Next