Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (45,971)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-1290 1Ibm 1Openpages Grc Platform May 13, 2026 Nov 1, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially le...Show more IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125151.Show less
CVE-2017-1147 1Ibm 1Openpages Grc Platform May 13, 2026 Nov 1, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially le...Show more IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 122200.Show less
CVE-2016-3048 1Ibm 1Openpages Grc Platform May 13, 2026 Nov 1, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially le...Show more IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 114711.Show less
CVE-2017-1001001 1Pluxml 1Pluxml May 13, 2026 Nov 1, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 PluXml version 5.6 is vulnerable to stored cross-site scripting vulnerability, within the article creation page, which can result in escalation of privileges.
CVE-2017-15273 1Mahara 1Mahara May 13, 2026 Oct 31, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a potential dangerous payload, e.g., XSS code, to be saved as titles in internal arte...Show more Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a potential dangerous payload, e.g., XSS code, to be saved as titles in internal artefacts.Show less
CVE-2017-14752 1Mahara 1Mahara May 13, 2026 Oct 31, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a potential dangerous payload, e.g., XSS code, to be saved as their first name, last...Show more Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a potential dangerous payload, e.g., XSS code, to be saved as their first name, last name, or display name in the profile fields that can cause issues such as escalation of privileges or unknown execution of malicious code when replying to messages in Mahara.Show less
CVE-2017-14357 1Hp 2Arcsight Enterprise Security Manager Arcsight Enterprise Security Manager Express May 13, 2026 Oct 31, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Reflected and Stored Cross-Site Scripting (XSS) vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could be exploited remotely...Show more A Reflected and Stored Cross-Site Scripting (XSS) vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could be exploited remotely to allow Reflected and Stored Cross-Site Scripting (XSS)Show less
CVE-2017-3933 1Mcafee 1Network Data Loss Prevention May 13, 2026 Oct 31, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via a cross site request forgery attack.
CVE-2017-14373 1Emc 1Rsa Authentication Manager May 13, 2026 Oct 31, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 EMC RSA Authentication Manager 8.2 SP1 P4 and earlier contains a reflected cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVE-2016-10699 1Dlink 1Dsl 2740e Firmware May 13, 2026 Oct 31, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 D-Link DSL-2740E 1.00_BG_20150720 devices are prone to persistent XSS attacks in the username and password fields: a remote unauthenticated user may craft logins and passwords with script tags in them. Because there is n...Show more D-Link DSL-2740E 1.00_BG_20150720 devices are prone to persistent XSS attacks in the username and password fields: a remote unauthenticated user may craft logins and passwords with script tags in them. Because there is no sanitization in the input fields, an unaware logged-in administrator may be a victim when checking the router logs.Show less
CVE-2017-16230 1Typecho 1Typecho May 13, 2026 Oct 30, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a new article, and add payload in the article content, resulting in XSS via index.php/action/contents-post-edit.
CVE-2012-5636 1Apache 1Wicket May 13, 2026 Oct 30, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via vectors related to <script>...Show more Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via vectors related to <script> tags in a rendered response.Show less
CVE-2017-15888 1Synology 1Audio Station May 13, 2026 Oct 30, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in Custom Internet Radio List in Synology Audio Station before 6.3.0-3260 allows remote authenticated attackers to inject arbitrary web script or HTML via the NAME parameter.
CVE-2009-1198 1Apache 1Juddi May 13, 2026 Oct 30, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Apache jUDDI before 2.0 allows remote attackers to inject arbitrary web script or HTML via the dsname parameter to happyjuddi.jsp.
CVE-2017-12460 1Barco 2Clickshare Csc 1 Firmware Clickshare Csm 1 Firmware May 13, 2026 Oct 30, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in Barco ClickShare CSM-1 firmware before v1.7.0.3 and CSC-1 firmware before v1.10.0.10. An authenticated user can manage the wallpaper collection in the webUI to be shown as background on the Cl...Show more An issue was discovered in Barco ClickShare CSM-1 firmware before v1.7.0.3 and CSC-1 firmware before v1.10.0.10. An authenticated user can manage the wallpaper collection in the webUI to be shown as background on the ClickShare product. By uploading a wallpaper with a specially crafted name, an HTML injection can be triggered as special characters are not neutralized before output.Show less
CVE-2017-15948 1Grabaperch 1Perch May 13, 2026 Oct 28, 2017 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Perch Content Management System 3.0.3 allows unrestricted file upload (with resultant XSS) via the Asset Title field in conjunction with the Select File field. This is exploitable with a Limited Admin account.
CVE-2017-15947 1Aspsource 1Simple Asc Content Management System May 13, 2026 Oct 28, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Simple ASC Content Management System v1.2 has XSS in the location field in the sign function, related to guestbook.asp, formgb.asp, and msggb.asp.
CVE-2017-15936 1Artica 1Pandora Fms May 13, 2026 Oct 27, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In Artica Pandora FMS version 7.0, an Attacker with write Permission can create an agent with an XSS Payload; when a user enters the agent definitions page, the script will get executed.
CVE-2017-15934 1Artica 1Pandora Fms May 13, 2026 Oct 27, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Artica Pandora FMS version 7.0 is vulnerable to stored Cross-Site Scripting in the map name parameter.
CVE-2017-7733 1Fortinet 1Fortios May 13, 2026 Oct 27, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 and 5.6.0 allows a remote unauthenticated attacker to execute arbitrary javascript code via webUI "Login Disclaimer" redir parameter.

Previous 1...189418951896...2299 Next