Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,813)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-3708 1Dell 1Emc Isilonsd Management Server Jun 17, 2026 Apr 17, 2019 N/A· v4 9.6 CRITICAL· v3 9.3 HIGH· v2 IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while uploading an OVA file. A remote attacker can trick an admin user to potentially exploit this vulnerability to execute malicious HTML or...Show more IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while uploading an OVA file. A remote attacker can trick an admin user to potentially exploit this vulnerability to execute malicious HTML or JavaScript code in the context of the admin user.Show less
CVE-2018-13809 1Siemens 2Cp 1604 Firmware Cp 1616 Firmware Nov 21, 2024 Apr 17, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). The integrated web server of the affected CP devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked...Show more A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). The integrated web server of the affected CP devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into following a malicious link. User interaction is required for a successful exploitation. At the time of advisory publication no public exploitation of this vulnerability was known.Show less
CVE-2018-18019 1Tribulant 1Slideshow Gallery Nov 21, 2024 Apr 15, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide[title], Slide[media_file], or Slide[image_url] parameter.
CVE-2018-18017 1Tribulant 1Slideshow Gallery Nov 21, 2024 Apr 15, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter.
CVE-2018-16967 1Filemanagerpro 1File Manager Nov 21, 2024 Apr 15, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.
CVE-2018-17586 1Wpfastestcache 1Wp Fastest Cache Nov 21, 2024 Apr 15, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_timeout_pages action.
CVE-2018-17585 1Wpfastestcache 1Wp Fastest Cache Nov 21, 2024 Apr 15, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the wpfastestcacheoptions wpFastestCachePreload_number or wpFastestCacheLanguage parameter.
CVE-2018-17583 1Wpfastestcache 1Wp Fastest Cache Nov 21, 2024 Apr 15, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_exclude_pages action.
CVE-2018-18261 1Bijiadao 1Waimai Super Cms Nov 21, 2024 Apr 15, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In waimai Super Cms 20150505, there is an XSS vulnerability via the /admin.php/Foodcat/addsave fcname parameter.
CVE-2018-16259 1Soflyy 1Wp All Import Nov 21, 2024 Apr 12, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a log...Show more There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administratorShow less
CVE-2018-16258 1Soflyy 1Wp All Import Nov 21, 2024 Apr 12, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in...Show more There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administratorShow less
CVE-2018-16257 1Soflyy 1Wp All Import Nov 21, 2024 Apr 12, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in admin...Show more There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administratorShow less
CVE-2018-16256 1Soflyy 1Wp All Import Nov 21, 2024 Apr 12, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged i...Show more There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administratorShow less
CVE-2018-16255 1Soflyy 1Wp All Import Nov 21, 2024 Apr 12, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator,...Show more There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administratorShow less
CVE-2018-16254 1Soflyy 1Wp All Import Nov 21, 2024 Apr 12, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator,...Show more There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administratorShow less
CVE-2018-13137 1Pixelite 1Events Manager Nov 21, 2024 Apr 12, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-manager-options URI.
CVE-2019-1574 1Paloaltonetworks 1Expedition Migration Tool Jun 17, 2026 Apr 12, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition Migration tool 1.1.12 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the Devices View.
CVE-2019-6796 1Gitlab 1Gitlab Jun 17, 2026 Apr 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 2 of 2). The user status field contains a lack of input validation an...Show more An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 2 of 2). The user status field contains a lack of input validation and output encoding that results in a persistent XSS.Show less
CVE-2018-19202 1Mybb 1Mybb Nov 21, 2024 Apr 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript via the 'upsetting[bburl]' parameter.
CVE-2019-7219 1Zarafa 1Webaccess Jun 17, 2026 Apr 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE: this is a discontinued product. The issue was fixed in later Zarafa Webapp versions; however, some former Zarafa...Show more Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE: this is a discontinued product. The issue was fixed in later Zarafa Webapp versions; however, some former Zarafa Webapp customers use the related Kopano product instead.Show less

Previous 1...189818991900...2441 Next