Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,798)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2015-2230 1Synacor 1Zimbra Collaboration Server Nov 21, 2024 May 30, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console.
CVE-2018-14425 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 May 30, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before 8.8.9 Patch 1.
CVE-2018-10948 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 May 30, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs.
CVE-2019-12461 1Webport 1Web Port Jun 17, 2026 May 30, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Web Port 1.19.1 allows XSS via the /log type parameter.
CVE-2019-12460 1Webport 1Web Port Jun 17, 2026 May 30, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Web Port 1.19.1 allows XSS via the /access/setup type parameter.
CVE-2018-18631 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 May 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS.
CVE-2018-14013 1Synacor 1Zimbra Collaboration Suite Nov 21, 2024 May 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.
CVE-2019-12347 1Netgate 1Pfsense Jun 17, 2026 May 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action. The vulnerability occurs due to input validation errors.
CVE-2019-7129 1Adobe 1Experience Manager Forms Jun 17, 2026 May 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2019-4184 1Ibm 1Jazz Reporting Service Jun 17, 2026 May 29, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Reporting Service 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...Show more IBM Jazz Reporting Service 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158974.Show less
CVE-2019-4139 1Ibm 1Cognos Analytics Jun 17, 2026 May 29, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Cognos Analytics 11.0, 11.1.0, and 11.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially l...Show more IBM Cognos Analytics 11.0, 11.1.0, and 11.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158335.Show less
CVE-2019-4137 1Ibm 1Spectrum Control Jun 17, 2026 May 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionali...Show more IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158333.Show less
CVE-2019-0221 1Apache 1Tomcat Jun 17, 2026 May 28, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printen...Show more The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.Show less
CVE-2018-13375 1Fortinet 2Fortianalyzer Fortimanager Nov 21, 2024 May 28, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request containing malicious scripts in the HOSTNAME param...Show more An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request containing malicious scripts in the HOSTNAME parameter. The malicious script code is executed while viewing the logs in FortiAnalyzer and FortiManager (with FortiAnalyzer feature enabled).Show less
CVE-2019-12362 1Phome 1Empirecms Jun 17, 2026 May 27, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php.
CVE-2019-12361 1Phome 1Empirecms Jun 17, 2026 May 27, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php regis...Show more EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page.Show less
CVE-2019-12345 1Kibokolabs 1Hostel Jun 17, 2026 May 27, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in the Kiboko Hostel plugin before 1.1.4 for WordPress.
CVE-2019-7092 1Adobe 1Coldfusion Jun 17, 2026 May 24, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a cross site scripting vulnerability. Successful exploitation could lead to information disclosure .
CVE-2019-10685 1Heidelberg 1Prinect Archiver Jun 17, 2026 May 24, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Heidelberg Prinect Archiver v2013 release 1.0.
CVE-2018-12624 1Eventum Project 1Eventum Nov 21, 2024 May 24, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Eventum 3.5.0. /htdocs/post_note.php has XSS via the garlic_prefix parameter.

Previous 1...188618871888...2440 Next