CWE-79
48,928 CVEs • Abstraction: Base • Likelihood of Exploit: High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVEs (48,928)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
4F5 GetbootstrapRedhat+1 more16Big Ip Access Policy Manager Big Ip Advanced Firewall ManagerBig Ip Analytics+13 moreJun 17, 2026 Feb 20, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. |
The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser par...Show more |
The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href par...Show more |
4Debian FedoraprojectGoogle+1 more6Chrome Debian LinuxEnterprise Linux Desktop+3 moreJun 17, 2026 Feb 19, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 A missing case for handling special schemes in permission request checks in Extensions in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to install a malicious extension to bypass extension...Show more |
data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page. |
Collabtive 3.1 allows XSS via the manageuser.php?action=profile id parameter. |
An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box (for the website statistics code). |
imcat 4.5 has Stored XSS via the root/run/adm.php fm[instop][note] parameter. |
admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header. |
In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay parameter. |
In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter. |
skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControl[MinTiltRange] parameter. |
includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages. |
VNote 2.2 has XSS via a new text note. |
ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter. |
Verydows 2.0 has XSS via the index.php?c=main a parameter, as demonstrated by an a=index[XSS] value. |
1Responsive Video News Script Project 1Responsive Video News Script Jun 17, 2026 Feb 16, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 PHP Scripts Mall Responsive Video News Script has XSS via the Search Bar. This might, for example, be leveraged for HTML injection or URL redirection. |
1Ibm 2Infosphere Information Governance Catalog Infosphere Information Server On CloudNov 21, 2024 Feb 15, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality pote...Show more |
1Sap 1Businessobjects Bi Platform Jun 17, 2026 Feb 15, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 SAP WebIntelligence BILaunchPad, versions 4.10, 4.20, does not sufficiently encode user-controlled inputs in generated HTML reports, resulting in Cross-Site Scripting (XSS) vulnerability. |
SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. |