← Back
CWE-79

48,846 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,846)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2017-16774
1Synology
1Diskstation Manager
Jan 14, 2025
Apr 1, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross-site scripting (XSS) vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager (DSM) before 6.1.4-15217-3 allows remote authenticated users to inject arbitrary web script or HTML via the...Show more
Cross-site scripting (XSS) vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager (DSM) before 6.1.4-15217-3 allows remote authenticated users to inject arbitrary web script or HTML via the package parameter.Show less
CVE-2019-10646
1Wolfcms
1Wolf Cms
Jun 17, 2026
Mar 30, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Wolf CMS v0.8.3.1 is affected by cross site scripting (XSS) in the module Add Snippet (/?/admin/snippet/add). This allows an attacker to insert arbitrary JavaScript as user input, which will be executed whenever the affe...Show more
Wolf CMS v0.8.3.1 is affected by cross site scripting (XSS) in the module Add Snippet (/?/admin/snippet/add). This allows an attacker to insert arbitrary JavaScript as user input, which will be executed whenever the affected snippet is loaded.Show less
CVE-2018-19201
1Mybb
1Mybb
Nov 21, 2024
Mar 29, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaScript via the 'username' parameter.
CVE-2019-9919
1Harmistechnology
1Je Messenger
Jun 17, 2026
Mar 29, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to craft messages in a way that JavaScript gets executed on the side of the receiving user when the message is opened, aka XS...Show more
An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to craft messages in a way that JavaScript gets executed on the side of the receiving user when the message is opened, aka XSS.Show less
CVE-2019-9605
1Online Lottery Php Readymade Script Project
1Online Lottery Php Readymade Script
Jun 17, 2026
Mar 29, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Reflected Cross-site Scripting (XSS) via the err value in a .ico picture upload.
CVE-2019-0224
1Apache
1Jspwiki
Jun 17, 2026
Mar 28, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database, nor would an attacker be able to execute...Show more
In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database, nor would an attacker be able to execute js on someone else's browser; only on its own browser.Show less
CVE-2019-9167
1Nagios
1Nagios Xi
Jun 17, 2026
Mar 28, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Nagios XI before 5.5.11 allows attackers to inject arbitrary web script or HTML via the xiwindow parameter.
CVE-2019-1003042
1Jenkins
1Lockable Resources
Jun 17, 2026
Mar 28, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.
CVE-2019-9164
1Nagios
1Nagios Xi
Jun 17, 2026
Mar 28, 2019
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job.
CVE-2019-10260
1Totaljs
1Total.js Cms
Jun 17, 2026
Mar 28, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).
CVE-2019-10254
2Misp
Misp Project
2Misp
Misp
Jun 22, 2026
Mar 28, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability.
CVE-2018-15585
1Sir
1Gnuboard
Nov 21, 2024
Mar 27, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-Site Scripting (XSS) vulnerability in newwinform.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter.
CVE-2019-10238
1Sitemagic
1Sitemagic
Jun 17, 2026
Mar 27, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter.
CVE-2018-19644
1Microfocus
1Solutions Business Manager
Nov 21, 2024
Mar 27, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Reflected cross site script issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.
CVE-2017-18364
1Frank Karau
1Phpfk
Nov 21, 2024
Mar 27, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter.
CVE-2019-5926
1Kinagacms Project
1Kinagacms
Jun 17, 2026
Mar 27, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting vulnerability in KinagaCMS versions prior to 6.5 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2019-3847
1Moodle
1Moodle
Jun 17, 2026
Mar 27, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScrip...Show more
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped when being viewed by the user logging in on their behalf.Show less
CVE-2018-10934
1Redhat
2Jboss Enterprise Application Platform
Single Sign On
Nov 21, 2024
Mar 27, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privi...Show more
A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users.Show less
CVE-2019-10118
1Snipeitapp
1Snipe It
Jun 17, 2026
Mar 27, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.
CVE-2016-10744
1Select2
1Select2
Nov 21, 2024
Mar 27, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.