← Back
CWE-79

48,776 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,776)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-13127
2Draw
Jgraph
2Draw.io Diagrams
Mxgraph
Jun 17, 2026
Jul 1, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Improper input validation/sanitization of a color field leads to XSS. This is as...Show more
An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Improper input validation/sanitization of a color field leads to XSS. This is associated with javascript/examples/grapheditor/www/js/Dialogs.js.Show less
CVE-2019-12970
1Squirrelmail
1Squirrelmail
Jun 17, 2026
Jul 1, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from...Show more
XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of (for example) a NOEMBED, NOFRAMES, NOSCRIPT, or TEXTAREA element.Show less
CVE-2018-20849
1Arastta
1Ecommerce
Nov 21, 2024
Jun 30, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Arastta eCommerce 1.6.2 is vulnerable to XSS via the PATH_INFO to the login/ URI.
CVE-2018-20848
1Peel
1Peel Shopping
Nov 21, 2024
Jun 30, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Advisto PEEL SHOPPING 9.0.0 has CSRF via en/achat/caddie_ajout.php and en/achat/caddie_affichage.php, as demonstrated by an XSS payload in the couleurId[0] parameter to the latter.
CVE-2019-11828
1Synology
1Office
Jun 17, 2026
Jun 30, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross-site scripting (XSS) vulnerability in Chart in Synology Office before 3.1.4-2771 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2019-11827
1Synology
1Note Station
Jun 17, 2026
Jun 30, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross-site scripting (XSS) vulnerability in SYNO.NoteStation.Shard in Synology Note Station before 2.5.3-0863 allows remote attackers to inject arbitrary web script or HTML via the object_id parameter.
CVE-2019-11825
1Synology
1Calendar
Jun 17, 2026
Jun 30, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross-site scripting (XSS) vulnerability in Event Editor in Synology Calendar before 2.3.0-0615 allows remote attackers to inject arbitrary web script or HTML via the title parameter.
CVE-2019-13072
1Zoneminder
1Zoneminder
Jun 17, 2026
Jun 30, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Stored XSS in the Filters page (Name field) in ZoneMinder 1.32.3 allows a malicious user to embed and execute JavaScript code in the browser of any user who navigates to this page.
CVE-2019-13068
1Grafana
1Grafana
Jun 17, 2026
Jun 30, 2019
N/A· v4
5.4 MEDIUM· v3
4.3 MEDIUM· v2
public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).
CVE-2019-12932
1Seeddms
1Seeddms
Jun 17, 2026
Jun 28, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A stored XSS vulnerability was found in SeedDMS 5.1.11 due to poorly escaping the search result in the autocomplete search form placed in the header of out/out.Viewfolder.php.
CVE-2018-20814
2Ivanti
Pulsesecure
2Connect Secure
Pulse Policy Secure
Nov 21, 2024
Jun 28, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An XSS issue was found with Psaldownload.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.3R2 before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4R2. This is not applicable to PCS 8.1RX or PPS 5.2RX.
CVE-2018-20808
1Ivanti
1Connect Secure
Nov 21, 2024
Jun 28, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An XSS issue has been found with rd.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R3 due to improper header sanitization. This is not applicable to 8.1RX.
CVE-2018-20807
1Ivanti
1Connect Secure
Nov 21, 2024
Jun 28, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1.x before 8.1R12, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 due to one of the URL parameters not being sanitized properly.
CVE-2018-17560
1Teamwire
1Teamwire
Nov 21, 2024
Jun 28, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The admin interface of the Grouptime Teamwire Client 1.5.1 prior to 1.9.0 on-premises messenger server allows stored XSS. All backend versions prior to prod-2018-11-13-15-00-42 are affected.
CVE-2018-14919
1Loytec
1Lgate 902 Firmware
Nov 21, 2024
Jun 28, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
LOYTEC LGATE-902 6.3.2 devices allow XSS.
CVE-2019-10177
1Redhat
1Cloudforms Management Engine
Jun 17, 2026
Jun 27, 2019
N/A· v4
6.5 MEDIUM· v3
6.0 MEDIUM· v2
A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute...Show more
A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users.Show less
CVE-2018-6145
1Google
1Chrome
Jun 17, 2026
Jun 27, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Insufficient data validation in HTML parser in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
CVE-2018-6128
1Google
1Chrome
Jun 17, 2026
Jun 27, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Incorrect URL parsing in WebKit in Google Chrome on iOS prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVE-2019-12581
1Zyxel
9Uag2100 Firmware
Uag4100 FirmwareUag5100 Firmware+6 more
Jun 17, 2026
Jun 27, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject arbitrary web script or HTML via the err_msg...Show more
A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject arbitrary web script or HTML via the err_msg parameter.Show less
CVE-2019-4250
1Ibm
7Rational Collaborative Lifecycle Management
Rational Doors Next GenerationRational Engineering Lifecycle Manager+4 more
Jun 17, 2026
Jun 27, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Jazz Foundation products (IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI t...Show more
IBM Jazz Foundation products (IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159648.Show less