CWE-79
48,774 CVEs • Abstraction: Base • Likelihood of Exploit: High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVEs (48,774)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Pingidentity 1Agentless Integration Kit Jun 17, 2026 Jul 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in Ping Identity Agentless Integration Kit before 1.5. |
D-Link DIR-655 C devices before 3.02B05 BETA03 allow XSS, as demonstrated by the /www/ping_response.cgi ping_ipaddr parameter, the /www/ping6_response.cgi ping6_ipaddr parameter, and the /www/apply_sec.cgi html_response_...Show more |
1Nuxtjs 2@nuxt/devalue Nuxt.jsJun 17, 2026 Jul 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 @nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS. |
1Zohocorp 1Manageengine Assetexplorer Jun 17, 2026 Jul 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via ResourcesAttachments.jsp with the parameter pageName. |
1Zohocorp 1Manageengine Assetexplorer Jun 17, 2026 Jul 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swType or swComplianceType. |
1Zohocorp 1Manageengine Assetexplorer Jun 17, 2026 Jul 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter. |
1Zohocorp 1Manageengine Servicedesk Plus Jun 17, 2026 Jul 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field. |
1Zohocorp 1Manageengine Servicedesk Plus Jun 17, 2026 Jul 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189. |
1Zohocorp 1Manageengine Assetexplorer Jun 17, 2026 Jul 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the SearchN.do search field. |
1Jenkins 1Dependency Graph Viewer Jun 17, 2026 Jul 11, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided we...Show more |
1Jenkins 1Embeddable Build Status Jun 17, 2026 Jul 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScript into the response of this plugin. |
1Dwbooster 1Appointment Hour Booking Jun 17, 2026 Jul 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1. |
Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS). |
A cross-site scripting (XSS) vulnerability in static/js/trape.js in Trape through 2019-05-08 allows remote attackers to inject arbitrary web script or HTML via the country, query, or refer parameter to the /register URI,...Show more |
SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. |
1Sap 1Businessobjects Business Intelligence Jun 17, 2026 Jul 10, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. |
1Sap 2Netweaver Application Server Abap Netweaver As AbapJun 17, 2026 Jul 10, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. |
The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could thus mislead a user to believe this information is from the l...Show more |
SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. |
In e107 v2.1.7, output without filtering results in XSS. |