Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,849)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-3808 1Moodle 1Moodle Jun 17, 2026 Mar 25, 2019 N/A· v4 5.4 MEDIUM· v3 4.0 MEDIUM· v2 A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have...Show more A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use by trusted users, and is only assigned to teachers and managers by default.Show less
CVE-2019-3480 1Hp 1Arcsight Logger Jun 17, 2026 Mar 25, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Mitigates a stored/reflected XSS issue in ArcSight Logger versions prior to 6.7.
CVE-2019-10016 1Gforge 1Advanced Server Jun 17, 2026 Mar 25, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 GForge Advanced Server 6.4.4 allows XSS via the commonsearch.php words parameter, as demonstrated by a snippet/search/?words= substring.
CVE-2019-10027 1Phpcms 1Phpcms Jun 17, 2026 Mar 25, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen.
CVE-2019-10017 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Mar 24, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" action to the File Picker.
CVE-2019-10010 1Thephpleague 1Commonmark Jun 17, 2026 Mar 24, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped dur...Show more Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than CVE-2018-20583.Show less
CVE-2019-9978 1Warfareplugins 2Social Warfare Social Warfare Pro Jun 17, 2026 Mar 24, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social...Show more The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.Show less
CVE-2018-20165 1Opentext 1Opentext Portal Nov 21, 2024 Mar 22, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in OpenText Portal 7.4.4 allows remote attackers to inject arbitrary web script or HTML via the vgnextoid parameter to a menuitem URI.
CVE-2019-9925 1S Cms 1S Cms Jun 17, 2026 Mar 22, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 S-CMS PHP v1.0 has XSS in 4.edu.php via the S_id parameter.
CVE-2019-9914 1Yop Poll 1Yop Poll Jun 17, 2026 Mar 22, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll_id XSS.
CVE-2019-9913 13cx 1Live Chat Jun 17, 2026 Mar 22, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS.
CVE-2019-9912 1Codecabin 1Wp Go Maps Jun 17, 2026 Mar 22, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO.
CVE-2019-9911 1Nextscripts 1Social Networks Auto Poster Jun 17, 2026 Mar 22, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS.
CVE-2019-9910 1King Theme 1Kingcomposer Jun 17, 2026 Mar 22, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS.
CVE-2019-9909 1Givewp 1Givewp Jun 17, 2026 Mar 22, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS.
CVE-2019-9908 1Hivewebstudios 1Font Organizer Jun 17, 2026 Mar 22, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php manage_font_id XSS.
CVE-2015-6462 1Schneider Electric 11Bmxnoc0401 Firmware Bmxnoe0100 FirmwareBmxnoe0110 Firmware+8 more Nov 21, 2024 Mar 21, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Reflected Cross-Site Scripting (nonpersistent) allows an attacker to craft a specific URL, which contains Java script that will be executed on the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110...Show more Reflected Cross-Site Scripting (nonpersistent) allows an attacker to craft a specific URL, which contains Java script that will be executed on the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC client browser.Show less
CVE-2019-9094 1Humhub 1Humhub Jun 17, 2026 Mar 21, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in /s/adada/cfiles/upload in Humhub 1.3.10 Community Edition. The user-supplied input containing JavaScript in the filename is echoed back in JavaScript...Show more A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in /s/adada/cfiles/upload in Humhub 1.3.10 Community Edition. The user-supplied input containing JavaScript in the filename is echoed back in JavaScript code, which resulted in XSS.Show less
CVE-2019-9093 1Humhub 1Humhub Jun 17, 2026 Mar 21, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in file/file/upload in Humhub 1.3.10 Community Edition. The user-supplied input containing a JavaScript payload in the filename parameter is echoed back...Show more A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in file/file/upload in Humhub 1.3.10 Community Edition. The user-supplied input containing a JavaScript payload in the filename parameter is echoed back, which resulted in reflected XSS.Show less
CVE-2019-8938 1Vertrigoserv Project 1Vertrigoserv Jun 17, 2026 Mar 21, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 VertrigoServ 2.17 allows XSS via the /inc/extensions.php ext parameter.

Previous 1...190519061907...2443 Next