CWE-79
48,928 CVEs • Abstraction: Base • Likelihood of Exploit: High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVEs (48,928)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI. |
An issue was discovered in ZrLog 2.0.3. There is stored XSS in the file upload area via a crafted attached/file/ pathname. |
XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter. |
An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note. |
An issue was discovered in UCMS 1.4.6. There is XSS in the title bar, as demonstrated by a do=list request. |
An issue was found in HYBBS through 2016-03-08. There is an XSS vulnerablity via an article title to post.html. |
1Simplemachines 1Simple Machines Forum Nov 21, 2024 Mar 7, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Simple Machines Forum (SMF) 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter. |
1Tibco 3Jasperreports Server JaspersoftJaspersoft Reporting And AnalyticsNov 21, 2024 Mar 7, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The repository component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TI...Show more |
1Pivotal Software 1Operations Manager Jun 17, 2026 Mar 7, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, contains a reflected cross site scripting vulnerability. A remote...Show more |
1Personal Video Collection Script Project 1Personal Video Collection Script Jun 17, 2026 Mar 6, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 PHP Scripts Mall Personal Video Collection Script 4.0.4 has Stored XSS via the "Update profile" feature. |
1Ibm 2Websphere Application Server Websphere Virtual EnterpriseJun 17, 2026 Mar 6, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially le...Show more |
1Ibm 1Rational Doors Next Generation Nov 21, 2024 Mar 6, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM DOORS Next Generation (DNG/RRC) 6.0.2 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality pot...Show more |
1Ibm 1Rational Doors Next Generation Nov 21, 2024 Mar 6, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.2 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intend...Show more |
AppCMS 2.0.101 allows XSS via the upload/callback.php params parameter. |
A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter. |
A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter. |
A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE before 19.49.1500.0 allows remote attackers to inject arbitrary web script or HTML via the brandUrl parameter. |
1Microsoft 1Team Foundation Server Jun 17, 2026 Mar 5, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CV...Show more |
1Microsoft 1Team Foundation Server Jun 17, 2026 Mar 5, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CV...Show more |
1Microsoft 1Sharepoint Enterprise Server Jun 17, 2026 Mar 5, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Elevation of Privileg...Show more |