Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,846)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-11003 1Materializecss 1Materialize Jun 17, 2026 Apr 8, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In Materialize through 1.0.0, XSS is possible via the Autocomplete feature.
CVE-2019-11002 1Materializecss 1Materialize Jun 17, 2026 Apr 8, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In Materialize through 1.0.0, XSS is possible via the Tooltip feature.
CVE-2018-19006 1Osisoft 1Pi Vision Nov 21, 2024 Apr 8, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where displays that reference AF elements and attributes containing JavaScript are affected...Show more OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where displays that reference AF elements and attributes containing JavaScript are affected. This vulnerability requires the ability of authorized AF users to store JavaScript in AF elements and attributes.Show less
CVE-2019-10905 1Parsedown 1Parsedown Jun 17, 2026 Apr 6, 2019 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script (already running on the affected page) executes the contents of any eleme...Show more Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script (already running on the affected page) executes the contents of any element with a specific class. This occurs because spaces are permitted in code block infostrings, which interferes with the intended behavior of a single class name beginning with the language- substring.Show less
CVE-2019-10904 2Debian Roundup Tracker 2Debian Linux Roundup Jun 17, 2026 Apr 6, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.
CVE-2019-10887 1Salicru 1Slc 20 Cube3(5) Jun 17, 2026 Apr 5, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected HTML injection vulnerability on Salicru SLC-20-cube3(5) devices running firmware version cs121-SNMP v4.54.82.130611 allows remote attackers to inject arbitrary HTML elements via a /DataLog.csv?log= or /AlarmL...Show more A reflected HTML injection vulnerability on Salicru SLC-20-cube3(5) devices running firmware version cs121-SNMP v4.54.82.130611 allows remote attackers to inject arbitrary HTML elements via a /DataLog.csv?log= or /AlarmLog.csv?log= or /waitlog.cgi?name= or /chart.shtml?data= or /createlog.cgi?name= request.Show less
CVE-2018-20816 1Salesagility 1Suitecrm Nov 21, 2024 Apr 5, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hijacking. This issue affects the "add dashboard pages" featur...Show more An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hijacking. This issue affects the "add dashboard pages" feature where users can receive a malicious attack through a phished URL, with script executed.Show less
CVE-2019-1827 1Cisco 2Rv320 Firmware Rv325 Firmware Jun 17, 2026 Apr 4, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in the Online Help web service of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack...Show more A vulnerability in the Online Help web service of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the service. The vulnerability exists because the Online Help web service of an affected device insufficiently validates user-supplied input. An attacker could exploit this vulnerability by persuading a user of the service to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected service or access sensitive browser-based information.This vulnerability affects Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers running firmware releases prior to 1.4.2.22.Show less
CVE-2018-4377 1Apple 5Icloud Iphone OsItunes+2 more Nov 21, 2024 Apr 3, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
CVE-2018-4374 1Apple 5Icloud Iphone OsItunes+2 more Nov 21, 2024 Apr 3, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A logic issue was addressed with improved validation. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
CVE-2018-4345 1Apple 5Icloud Iphone OsItunes+2 more Nov 21, 2024 Apr 3, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.
CVE-2018-4309 1Apple 5Icloud Iphone OsItunes+2 more Nov 21, 2024 Apr 3, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.
CVE-2019-5422 1Buttle Project 1Buttle Jun 17, 2026 Apr 3, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitrary file on the server.
CVE-2019-10261 1Centos Webpanel 1Centos Web Panel Jun 17, 2026 Apr 3, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 CentOS Web Panel (CWP) 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fields via a "DNS Functions" "Edit Nameservers IPs" action.
CVE-2018-1913 1Ibm 1Doors Next Generation Nov 21, 2024 Apr 3, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intend...Show more IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152737.Show less
CVE-2018-1731 1Ibm 1Doors Next Generation Nov 21, 2024 Apr 3, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intend...Show more IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 147710.Show less
CVE-2018-18035 1Open Emr 1Openemr Nov 21, 2024 Apr 2, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system.
CVE-2018-17989 1Dlink 1Dsl 3782 Firmware Nov 21, 2024 Apr 1, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript or HTML payload inside the ACL page. The injected payload wo...Show more A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript or HTML payload inside the ACL page. The injected payload would be executed in a user's browser when "/cgi-bin/New_GUI/Acl.asp" is requested.Show less
CVE-2019-5888 1Overit 1Geocall Jun 17, 2026 Apr 1, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple XSS vulnerabilities were discovered in OverIT Geocall 6.3 before build 2:346977.
CVE-2018-13293 1Synology 1Diskstation Manager Jan 14, 2025 Apr 1, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL paramet...Show more Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter.Show less

Previous 1...190219031904...2443 Next