Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,928)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-9576 1Adenion 1Blog2social Jun 17, 2026 Mar 5, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS.
CVE-2019-9575 1Quizandsurveymaster 1Quiz And Survey Master Jun 17, 2026 Mar 5, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.
CVE-2019-6565 1Moxa 4Eds 405a Firmware Eds 408a FirmwareEds 510a Firmware+1 more Jun 17, 2026 Mar 5, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attacks, which may be used to send a malicious script.
CVE-2019-6528 1Psigridconnect 5Iec104 Security Proxy Firmware Smart Telecontrol Unit Tcg FirmwareTelecontrol Gateway 3g Firmware+2 more Jun 17, 2026 Mar 5, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions...Show more PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway XS-MU Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Telecontrol Gateway VM Versions 4.2.21, 5.0.27, 5.1.19, 6.0.16 and prior, and Smart Telecontrol Unit TCG Versions 5.0.27, 5.1.19, 6.0.16 and prior, and IEC104 Security Proxy Version 2.2.10 and prior The web application browser interprets input as active HTML, JavaScript, or VBScript, which could allow an attacker to execute arbitrary code.Show less
CVE-2019-4029 1Ibm 1Sterling B2b Integrator Jun 17, 2026 Mar 5, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potenti...Show more IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-force ID: 155907.Show less
CVE-2019-4028 1Ibm 1Sterling B2b Integrator Jun 17, 2026 Mar 5, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potenti...Show more IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155906.Show less
CVE-2019-4027 1Ibm 1Sterling B2b Integrator Jun 17, 2026 Mar 5, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potenti...Show more IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-ForceID: 155905.Show less
CVE-2019-6229 1Apple 5Icloud Iphone OsItunes+2 more Jun 17, 2026 Mar 5, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A logic issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead...Show more A logic issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to universal cross site scripting.Show less
CVE-2019-6228 1Apple 2Iphone Os Safari Jun 17, 2026 Mar 5, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue is fixed in iOS 12.1.3, Safari 12.0.3. Processing maliciously crafted web content may lead to a cross site...Show more A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue is fixed in iOS 12.1.3, Safari 12.0.3. Processing maliciously crafted web content may lead to a cross site scripting attack.Show less
CVE-2019-9570 1Yzmcms 1Yzmcms Jun 17, 2026 Mar 5, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/system_manage/save.html URI, related to the site_code parameter.
CVE-2017-15515 1Netapp 1Snapcenter Server Nov 21, 2024 Mar 4, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 NetApp SnapCenter Server prior to 4.0 is susceptible to cross site scripting vulnerability that could allow a privileged user to inject arbitrary scripts into the custom secondary policy label field.
CVE-2019-9567 1Incsub 1Forminator Jun 17, 2026 Mar 4, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.
CVE-2019-9551 1Wdoyo 1Doyocms Jun 17, 2026 Mar 4, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in DOYO (aka doyocms) 2.3 through 2015-05-06. It has admin.php XSS.
CVE-2019-9550 1Dhcms Project 1Dhcms Jun 17, 2026 Mar 3, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 DhCms through 2017-09-18 has admin.php?r=admin/Index/index XSS.
CVE-2019-8279 1Vanillaforums 1Vanilla Forums Jun 17, 2026 Mar 2, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum.
CVE-2019-8278 1Invisioncommunity 1Invision Power Board Jun 17, 2026 Mar 2, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Stored XSS in Invision Power Board versions 3.3.1 - 3.4.8 leads to Remote Code Execution.
CVE-2019-9226 1Baigo 1Baigo Cms Jun 17, 2026 Feb 28, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in baigo CMS 2.1.1. There is a persistent XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the opt[base][BG_SITE_NAME] parameter to the bg_console/index.ph...Show more An issue was discovered in baigo CMS 2.1.1. There is a persistent XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the opt[base][BG_SITE_NAME] parameter to the bg_console/index.php?m=opt&c=request URI.Show less
CVE-2018-20244 1Apache 1Airflow Nov 21, 2024 Feb 27, 2019 N/A· v4 5.5 MEDIUM· v3 3.5 LOW· v2 In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.
CVE-2019-8410 1Maccms 1Maccms Jun 17, 2026 Feb 27, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Maccms 8.0 allows XSS via the inc/config/cache.php t_key parameter because template/paody/html/vod_type.html mishandles the keywords parameter, and a/tpl/module/db.php only filters the t_name parameter (not t_key).
CVE-2019-6595 1F5 1Big Ip Access Policy Manager Jun 17, 2026 Feb 26, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in F5 BIG-IP Access Policy Manager (APM) 11.5.x and 11.6.x Admin Web UI.

Previous 1...191619171918...2447 Next