Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,811)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-11193 1Directadmin 1Directadmin Jun 17, 2026 Apr 30, 2019 N/A· v4 6.1 MEDIUM· v3 6.8 MEDIUM· v2 The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESELLER; an attacker can bypass the CSRF protection with this, and take over the administration panel.
CVE-2018-14875 1Polarisft 1Intellect Core Banking Nov 21, 2024 Apr 30, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. Reflected XSS exists with an authenticated session via the Customerid, formName, FrameId, or MODE parameter.
CVE-2018-20239 1Atlassian 8Application Links Confluence Data CenterConfluence Server+5 more Nov 21, 2024 Apr 30, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrar...Show more Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0.Show less
CVE-2015-9286 1Nodebb 1Nodebb Nov 21, 2024 Apr 30, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.
CVE-2018-2004 1Ibm 1Jazz Reporting Service Nov 21, 2024 Apr 29, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Reporting Service (JRS) 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentia...Show more IBM Jazz Reporting Service (JRS) 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155006.Show less
CVE-2019-3562 1Oculus 1Oculus Browser Jun 17, 2026 Apr 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the Oculus Browser starting from version 5.2.7 until 5.7.11.
CVE-2019-11592 1Webidsupport 1Webid Jun 17, 2026 Apr 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 WeBid 1.2.2 has reflected XSS via the id parameter to admin/deletenews.php, admin/editbannersuser.php, admin/editfaqscategory.php, or admin/excludeuser.php, or the offset parameter to admin/edituser.php.
CVE-2015-9285 1Esotalk 1Esotalk Nov 21, 2024 Apr 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 esoTalk 1.0.0g4 has XSS via the PATH_INFO to the conversations/ URI.
CVE-2019-11533 1Projectsend 1Projectsend Jun 17, 2026 Apr 26, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML.
CVE-2018-18276 1Profiles Project 1Profiles Nov 21, 2024 Apr 26, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 XSS exists in the ProFiles 1.5 component for Joomla! via the name or path parameter when creating a new folder in the administrative panel.
CVE-2018-15584 1Sir 1Gnuboard Nov 21, 2024 Apr 26, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-Site Scripting (XSS) vulnerability in adm/boardgroup_form_update.php and adm/boardgroup_list_update.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
CVE-2018-15582 1Sir 1Gnuboard Nov 21, 2024 Apr 26, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-Site Scripting (XSS) vulnerability in adm/sms_admin/num_book_write.php and adm/sms_admin/num_book_update.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
CVE-2018-15581 1Sir 1Gnuboard Nov 21, 2024 Apr 26, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-Site Scripting (XSS) vulnerability in adm/faqmasterformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
CVE-2018-15580 1Sir 1Gnuboard Nov 21, 2024 Apr 26, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-Site Scripting (XSS) vulnerability in adm/contentformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
CVE-2018-5124 1Mozilla 1Firefox Nov 21, 2024 Apr 26, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1.
CVE-2019-0186 1Apache 1Pluto Jun 17, 2026 Apr 26, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of t...Show more The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war fileShow less
CVE-2019-11543 2Ivanti Pulsesecure 3Connect Secure Pulse Connect SecurePulse Policy Secure Jun 17, 2026 Apr 26, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, and...Show more XSS exists in the admin web console in Pulse Secure Pulse Connect Secure (PCS) 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, and 5.2RX before 5.2R12.1.Show less
CVE-2018-18643 1Gitlab 1Gitlab Nov 21, 2024 Apr 25, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS.
CVE-2018-18824 1Wolfcms 1Wolf Cms Nov 21, 2024 Apr 25, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 WolfCMS v0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/file_manager/browse/.
CVE-2018-18823 1Wolfcms 1Wolf Cms Nov 21, 2024 Apr 25, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 WolfCMS 0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/file_manager/browse/.

Previous 1...189518961897...2441 Next