← Back
CWE-79

48,748 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,748)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-20877
1Cpanel
1Cpanel
Nov 21, 2024
Aug 1, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437).
CVE-2018-20876
1Cpanel
1Cpanel
Nov 21, 2024
Aug 1, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434).
CVE-2018-20875
1Cpanel
1Cpanel
Nov 21, 2024
Aug 1, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433).
CVE-2018-20874
1Cpanel
1Cpanel
Nov 21, 2024
Aug 1, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface (SEC-428).
CVE-2019-7000
1Avaya
1Aura Conferencing
Jun 17, 2026
Jul 31, 2019
N/A· v4
6.1 MEDIUM· v3
5.8 MEDIUM· v2
A Cross-Site Scripting (XSS) vulnerability in the Web UI of Avaya Aura Conferencing may allow code execution and potentially disclose sensitive information. Affected versions of Avaya Aura Conferencing include all 8.x ve...Show more
A Cross-Site Scripting (XSS) vulnerability in the Web UI of Avaya Aura Conferencing may allow code execution and potentially disclose sensitive information. Affected versions of Avaya Aura Conferencing include all 8.x versions prior to 8.0 SP14 (8.0.14). Prior versions not listed were not evaluated.Show less
CVE-2019-14456
1Opengear
1Opengear
Jun 17, 2026
Jul 31, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Opengear console server firmware releases prior to 4.5.0 have a stored XSS vulnerability related to serial port logging. If a malicious user of an external system (connected to a serial port on an Opengear console server...Show more
Opengear console server firmware releases prior to 4.5.0 have a stored XSS vulnerability related to serial port logging. If a malicious user of an external system (connected to a serial port on an Opengear console server) sends crafted text to a serial port (that has logging enabled), the text will be replayed when the logs are viewed. Exploiting this vulnerability requires access to the serial port and/or console server.Show less
CVE-2019-3958
1Wallaceit
1Wallacepos
Jun 17, 2026
Jul 31, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Insufficient output sanitization in WallacePOS 1.4.3 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks via a crafted sales transaction.
CVE-2019-10360
1Jenkins
1M2 Release
Jun 17, 2026
Jul 31, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A stored cross site scripting vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier allowed attackers to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.
CVE-2019-5458
1Http File Server Project
1Http File Server
Jun 17, 2026
Jul 30, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser.
CVE-2019-5457
1Min Http Server Project
1Min Http Server
Jun 17, 2026
Jul 30, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser.
CVE-2019-5450
1Nextcloud
1Nextcloud
Jun 17, 2026
Jul 30, 2019
N/A· v4
6.8 MEDIUM· v3
4.6 MEDIUM· v2
Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in the header bar when using basic HTML.
CVE-2018-20859
1Edx
1Edx Platform
Nov 21, 2024
Jul 30, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.
CVE-2019-14406
1Cpanel
1Cpanel
Jun 17, 2026
Jul 30, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).
CVE-2018-20868
1Cpanel
1Cpanel
Nov 21, 2024
Jul 30, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).
CVE-2018-20866
1Cpanel
1Cpanel
Nov 21, 2024
Jul 30, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).
CVE-2018-20865
1Cpanel
1Cpanel
Nov 21, 2024
Jul 30, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).
CVE-2019-14390
1Cpanel
1Cpanel
Jun 17, 2026
Jul 30, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).
CVE-2019-14387
1Cpanel
1Cpanel
Jun 17, 2026
Jul 30, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).
CVE-2019-14386
1Cpanel
1Cpanel
Jun 17, 2026
Jul 30, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).
CVE-2018-18570
1Planonsoftware
1Planon
Nov 21, 2024
Jul 29, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Planon before Live Build 41 has XSS.