Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,725)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-5397 1Hp 13par Service Processor Firmware Jun 17, 2026 Aug 9, 2019 N/A· v4 9.4 CRITICAL· v3 9.7 HIGH· v2 A remote bypass of security restrictions vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
CVE-2018-20858 1Edx 1Recommender Nov 21, 2024 Aug 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Recommender before 2018-07-18 allows XSS.
CVE-2019-14805 1Una 1Una Jun 17, 2026 Aug 9, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 studio/builder_menu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing.
CVE-2019-14804 1Una 1Una Jun 17, 2026 Aug 9, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing.
CVE-2019-14797 110web 1Photo Gallery Jun 17, 2026 Aug 9, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.
CVE-2019-14796 1Mq Woocommerce Products Price Bulk Edit Project 1Mq Woocommerce Products Price Bulk Edit Jun 17, 2026 Aug 9, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=update_options show_products_page_limit parameter.
CVE-2019-14791 1Codepeople 1Appointment Booking Calendar Jun 17, 2026 Aug 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.
CVE-2019-14799 1Foliovision 1Fv Flowplayer Video Player Jun 17, 2026 Aug 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.
CVE-2019-14792 1Codecabin 1Wp Go Maps Jun 17, 2026 Aug 9, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter.
CVE-2019-14787 1Tribulant 1Newsletters Jun 17, 2026 Aug 9, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter.
CVE-2019-14785 1Codepeople 1Cp Contact Form With Paypal Jun 17, 2026 Aug 9, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id parameter.
CVE-2017-18484 1Elementalpath 1Cognitoys Dino Firmware Nov 21, 2024 Aug 8, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cognitoys Dino devices allow XSS via the SSID.
CVE-2019-14774 1Getwooplugins 1Woo Variation Swatches Jun 17, 2026 Aug 8, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter.
CVE-2018-20962 1Backpackforlaravel 1Backpack\crud Nov 21, 2024 Aug 8, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.
CVE-2019-12397 1Apache 1Ranger Jun 17, 2026 Aug 8, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix.
CVE-2019-14772 1Verdaccio 1Verdaccio Jun 17, 2026 Aug 8, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 verdaccio before 3.12.0 allows XSS.
CVE-2019-14221 11crm 11crm On Premise Jun 17, 2026 Aug 8, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 1CRM On-Premise Software 8.5.7 allows XSS via a payload that is mishandled during a Run Report operation.
CVE-2016-10864 1Netgear 1Ex7000 Firmware Nov 21, 2024 Aug 8, 2019 N/A· v4 5.2 MEDIUM· v3 2.9 LOW· v2 NETGEAR EX7000 V1.0.0.42_1.0.94 devices allow XSS via the SSID.
CVE-2019-1973 1Cisco 2Enterprise Network Function Virtualization Infrastructure Enterprise Nfv Infrastructure Software Aug 24, 2026 Aug 8, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 A vulnerability in the web portal framework of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-b...Show more A vulnerability in the web portal framework of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to improper input validation of log file content stored on the affected device. An attacker could exploit this vulnerability by modifying a log file with malicious code and getting a user to view the modified log file. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or to access sensitive, browser-based information.Show less
CVE-2019-1956 1Cisco 1Spa112 2 Port Phone Adapter Firmware Jun 17, 2026 Aug 8, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 A vulnerability in the web-based interface of the Cisco SPA112 2-Port Phone Adapter could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against another user of the device. The vul...Show more A vulnerability in the web-based interface of the Cisco SPA112 2-Port Phone Adapter could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against another user of the device. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected device. An attacker could exploit this vulnerability by inserting malicious code in one of the configuration fields. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.Show less

Previous 1...185918601861...2437 Next