Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,774)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-13397 1Enhancesoft 1Osticket Jun 17, 2026 Jul 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Unauthenticated Stored XSS in osTicket 1.10.1 allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via arbitrary file extension while creating a support ticket.
CVE-2019-12748 1Typo3 1Typo3 Jun 17, 2026 Jul 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS.
CVE-2019-12927 1Mailenable 1Mailenable Jun 17, 2026 Jul 8, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exp...Show more MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exploiting this vulnerability.Show less
CVE-2019-12930 1Wikindx Project 1Wikindx Jun 17, 2026 Jul 8, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability in noMenu() and noSubMenu() in core/navigation/MENU.php in WIKINDX prior to version 5.8.1 allows remote attackers to inject arbitrary web script or HTML via the method parameter...Show more A cross-site scripting (XSS) vulnerability in noMenu() and noSubMenu() in core/navigation/MENU.php in WIKINDX prior to version 5.8.1 allows remote attackers to inject arbitrary web script or HTML via the method parameter.Show less
CVE-2019-13414 1Boiteasite 1Rencontre Jun 17, 2026 Jul 8, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php.
CVE-2019-13374 1Dlink 1Central Wifimanager Jun 17, 2026 Jul 6, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting (XSS) vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to inject arbitrary web script or HTML via the in...Show more A cross-site scripting (XSS) vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to inject arbitrary web script or HTML via the index.php/Pay/passcodeAuth passcode parameter.Show less
CVE-2019-1931 1Cisco 1Secure Firewall Management Center Jun 17, 2026 Jul 6, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attac...Show more Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.Show less
CVE-2019-1930 1Cisco 1Secure Firewall Management Center Jun 17, 2026 Jul 6, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attac...Show more Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.Show less
CVE-2019-13345 2Debian Squid Cache 2Debian Linux Squid Jun 17, 2026 Jul 5, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.
CVE-2018-14027 1Digisol 1Dg Hr 3300 Firmware Nov 21, 2024 Jul 5, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Digisol Wireless Wifi Home Router HR-3300 allows XSS via the userid or password parameter to the admin login page.
CVE-2019-13341 11234n 1Minicms Jun 17, 2026 Jul 5, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user's cookie.
CVE-2019-13340 11234n 1Minicms Jun 17, 2026 Jul 5, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, CVE-2018-20520, and CVE-2019-131...Show more In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, CVE-2018-20520, and CVE-2019-13186.Show less
CVE-2019-13339 11234n 1Minicms Jun 17, 2026 Jul 5, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can be used to get a user's cookie.
CVE-2019-5972 1Sukimalab 1Online Lesson Booking Jun 17, 2026 Jul 5, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2019-5970 1Sukimalab 1Attendance Manager Jun 17, 2026 Jul 5, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in Attendance Manager 0.5.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2019-5967 1Joruri 1Joruri Cms 2017 Jun 17, 2026 Jul 5, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in Joruri CMS 2017 Release2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2019-5962 1Zoho 1Salesiq Jun 17, 2026 Jul 5, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2019-13239 1Glpi Project 1Glpi Jun 17, 2026 Jul 4, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture.
CVE-2018-20850 1Stormshield 1Stormshield Network Security Nov 21, 2024 Jul 4, 2019 N/A· v4 8.2 HIGH· v3 7.2 HIGH· v2 Stormshield Network Security 2.0.0 through 2.13.0 and 3.0.0 through 3.7.1 has self-XSS in the command line interface of the SNS web server.
CVE-2019-12842 1Jetbrains 1Teamcity Jun 17, 2026 Jul 3, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.2.

Previous 1...187618771878...2439 Next