Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (45,971)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2015-5532 1Strangerstudios 1Paid Memberships Pro May 13, 2026 Oct 23, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to members...Show more Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to membershiplevels.php, (2) memberslist.php, or (3) orders.php in adminpages/ or the (4) edit parameter to adminpages/membershiplevels.php.Show less
CVE-2015-5379 1Axigen 1Axigen Mail Server May 13, 2026 Oct 23, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 allows remote attackers to inject arbitrary web script or HTML via an email attachment.
CVE-2012-4569 1Letodms Project 1Letodms May 13, 2026 Oct 23, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in out/out.UsrMgr.php in LetoDMS (formerly MyDMS) before 3.3.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-4567 1Letodms Project 1Letodms May 13, 2026 Oct 23, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in (1) inc/inc.ClassUI.php or (2) out/...Show more Multiple cross-site scripting (XSS) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in (1) inc/inc.ClassUI.php or (2) out/out.DocumentNotify.php.Show less
CVE-2011-4333 1Scilico 1Labwiki May 13, 2026 Oct 23, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in LabWiki 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) from parameter to index.php or the (2) page_no parameter to recentc...Show more Multiple cross-site scripting (XSS) vulnerabilities in LabWiki 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) from parameter to index.php or the (2) page_no parameter to recentchanges.php.Show less
CVE-2017-15812 1Easy Appointments 1Easy Appointments May 13, 2026 Oct 23, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel.
CVE-2017-15811 1Pootlepress 1Pootle Button May 13, 2026 Oct 23, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php.
CVE-2017-15810 1Popcash 1Popcash.net Code Integration Tool May 13, 2026 Oct 23, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php.
CVE-2017-15809 1Phpmyfaq 1Phpmyfaq May 13, 2026 Oct 23, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In phpMyFaq before 2.9.9, there is XSS in admin/tags.main.php via a crafted tag.
CVE-2016-10516 1Palletsprojects 1Werkzeug May 13, 2026 Oct 23, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject...Show more Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.Show less
CVE-2017-15687 1Logitech 1Media Server May 13, 2026 Oct 23, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 DOM Based Cross Site Scripting (XSS) exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1 via a crafted URI.
CVE-2017-15380 1Softwarepublico 1E Sic May 13, 2026 Oct 23, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in the E-Sic 1.0 /cadastro/index.php URI (aka the requester's registration area) via the nome parameter.
CVE-2017-7109 1Apple 5Icloud Iphone OsItunes+2 more May 13, 2026 Oct 23, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected....Show more An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via crafted web content that incorrectly interacts with the Application Cache policy.Show less
CVE-2017-7089 1Apple 5Icloud Iphone OsItunes+2 more May 13, 2026 Oct 23, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. The issue involves the "WebKit" component. It allows remote attackers...Show more An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that is mishandled during parent-tab processing.Show less
CVE-2017-15736 1Spip 1Spip May 13, 2026 Oct 22, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows remote attackers to inject arbitrary web script or HTML via a crafted string, as demonstrated by a PGP field, related to prive/objets/contenu/...Show more Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7 allows remote attackers to inject arbitrary web script or HTML via a crafted string, as demonstrated by a PGP field, related to prive/objets/contenu/auteur.html and ecrire/inc/texte_mini.php.Show less
CVE-2017-15728 1Phpmyfaq 1Phpmyfaq May 13, 2026 Oct 22, 2017 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via metaDescription or metaKeywords.
CVE-2017-15727 1Phpmyfaq 1Phpmyfaq May 13, 2026 Oct 22, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment.
CVE-2010-3659 1Typo3 1Typo3 May 13, 2026 Oct 20, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated backend users to inject arbitrary web scrip...Show more Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to the extension manager, or unspecified parameters to unknown backend forms.Show less
CVE-2017-15291 1Tp Link 1Tl Mr3220 Firmware May 13, 2026 Oct 20, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in the Wireless MAC Filtering page in TP-LINK TL-MR3220 wireless routers allows remote attackers to inject arbitrary web script or HTML via the Description field.
CVE-2017-15648 1Phpsugar 1Php Melody May 13, 2026 Oct 19, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In PHPSUGAR PHP Melody before 2.7.3, page_manager.php has XSS via the page_title parameter.

Previous 1...189618971898...2299 Next