Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,928)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-9168 1Woocommerce 1Woocommerce Jun 17, 2026 Feb 26, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 WooCommerce before 3.5.5 allows XSS via a Photoswipe caption.
CVE-2019-9145 1Hsycms 1Hsycms Jun 17, 2026 Feb 25, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Hsycms V1.1. There is an XSS vulnerability via the name field to the /book page.
CVE-2019-9142 1B3log 1Symphony Jun 17, 2026 Feb 25, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java.
CVE-2018-20791 1Tecrail 1Responsive Filemanager Nov 21, 2024 Feb 25, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 tecrail Responsive FileManager 9.13.4 allows XSS via a media file upload with an XSS payload in the name, because of mishandling of the media_preview action.
CVE-2019-9110 1Wuzhicms 1Wuzhicms Jun 17, 2026 Feb 25, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in WUZHI CMS 4.1.0 via index.php?m=content&f=postinfo&v=listing&set_iframe=[XSS] to coreframe/app/content/postinfo.php.
CVE-2019-9109 1Wuzhicms 1Wuzhicms Jun 17, 2026 Feb 25, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in WUZHI CMS 4.1.0 via index.php?m=message&f=message&v=add&username=[XSS] to coreframe/app/message/message.php.
CVE-2019-9108 1Wuzhicms 1Wuzhicms Jun 17, 2026 Feb 25, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in WUZHI CMS 4.1.0 via index.php?m=core&f=map&v=baidumap&x=[XSS]&y=[XSS] to coreframe/app/core/map.php.
CVE-2019-9107 1Wuzhicms 1Wuzhicms Jun 17, 2026 Feb 25, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in WUZHI CMS 4.1.0 via index.php?m=attachment&f=imagecut&v=init&imgurl=[XSS] to coreframe/app/attachment/imagecut.php.
CVE-2019-9078 1Zzcms 1Zzcms Jun 17, 2026 Feb 24, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT.
CVE-2019-9066 1Php Appointment Booking Script Project 1Php Appointment Booking Script Jun 17, 2026 Feb 23, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 PHP Scripts Mall PHP Appointment Booking Script 3.0.3 allows HTML injection in a user profile.
CVE-2014-10078 1Vembu 1Storegrid Nov 21, 2024 Feb 23, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Vembu StoreGrid 4.4.x has XSS in interface/registercustomer/onlineregsuccess.php, interface/registerreseller/onlineregfailure.php, interface/registerclient/onlineregfailure.php, and interface/registercustomer/onlineregfa...Show more Vembu StoreGrid 4.4.x has XSS in interface/registercustomer/onlineregsuccess.php, interface/registerreseller/onlineregfailure.php, interface/registerclient/onlineregfailure.php, and interface/registercustomer/onlineregfailure.php.Show less
CVE-2018-18692 1Semcosoft 1Semcosoft Nov 21, 2024 Feb 23, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected Cross-Site scripting (XSS) vulnerability in SEMCO Semcosoft 5.3 allows remote attackers to inject arbitrary web scripts or HTML via the username parameter to the Login Form.
CVE-2019-9016 1Mopcms 1Mopcms Jun 17, 2026 Feb 22, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An XSS vulnerability was discovered in MOPCMS through 2018-11-30. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[name] parameter in a mod=column request, as demon...Show more An XSS vulnerability was discovered in MOPCMS through 2018-11-30. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[name] parameter in a mod=column request, as demonstrated by the /mopcms/X0AZgf(index).php?mod=column&ac=list&menuid=28&ac=add&menuid=29 URI.Show less
CVE-2019-1685 1Cisco 1Unity Connection Jun 17, 2026 Feb 21, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in the Security Assertion Markup Language (SAML) single sign-on (SSO) interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack aga...Show more A vulnerability in the Security Assertion Markup Language (SAML) single sign-on (SSO) interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Version 12.5 is affected.Show less
CVE-2019-1665 1Cisco 1Hyperflex Hx Data Platform Jun 17, 2026 Feb 21, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in the web-based management interface of Cisco HyperFlex software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management...Show more A vulnerability in the web-based management interface of Cisco HyperFlex software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Versions prior to 3.5(1a) are affected.Show less
CVE-2018-1947 1Ibm 1Security Identity Governance And Intelligence Nov 21, 2024 Feb 21, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin...Show more IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153427.Show less
CVE-2019-8984 1Altn 1Mdaemon Jun 17, 2026 Feb 21, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2).
CVE-2019-8983 1Altn 1Mdaemon Jun 17, 2026 Feb 21, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2).
CVE-2019-5727 1Splunk 1Splunk Jun 17, 2026 Feb 21, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6.0.x before 6.0.15 and Splunk Light before 6.6.0 has Persistent XSS, aka SPL-138...Show more Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6.0.x before 6.0.15 and Splunk Light before 6.6.0 has Persistent XSS, aka SPL-138827.Show less
CVE-2019-8953 1Netgate 1Haproxy Jun 17, 2026 Feb 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_listeners.php and haproxy_listeners_edit.php.

Previous 1...191719181919...2447 Next