Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,928)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-0251 1Sap 1Businessobjects Jun 17, 2026 Feb 15, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVE-2019-6589 1F5 13Big Ip Access Policy Manager Big Ip Advanced Firewall ManagerBig Ip Analytics+10 more Jun 17, 2026 Feb 14, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the BIG-IP TMUI (Traffic Management User Interfa...Show more On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the BIG-IP TMUI (Traffic Management User Interface) also known as the BIG-IP configuration utility.Show less
CVE-2018-20232 1Atlassian 2Jira Jira Server Nov 21, 2024 Feb 13, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability...Show more The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the rendering of retrieved content from a url location that could be manipulated by the up_projectid widget preference setting.Show less
CVE-2018-13403 1Atlassian 2Jira Jira Server Nov 21, 2024 Feb 13, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.12.4, and from version 7.13.0 before version 7.13.1 allows remote attackers to inject arbitrary HT...Show more The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.12.4, and from version 7.13.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a saved filter when displayed on a Jira dashboard.Show less
CVE-2018-12409 1Tibco 1Silver Fabric Nov 21, 2024 Feb 13, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The SOAP Admin API component of TIBCO Software Inc.'s TIBCO Silver Fabric contains a vulnerability that may allow reflected cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Silver Fab...Show more The SOAP Admin API component of TIBCO Software Inc.'s TIBCO Silver Fabric contains a vulnerability that may allow reflected cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Silver Fabric: versions up to and including 5.8.1.Show less
CVE-2019-8335 1Schoolcms 1Schoolcms Jun 17, 2026 Feb 13, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&id=[XSS].
CVE-2019-8334 1Schoolcms 1Schoolcms Jun 17, 2026 Feb 13, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&viewid=[XSS].
CVE-2019-7744 1Joomla 1Joomla Jun 17, 2026 Feb 12, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Joomla! before 3.9.3. Inadequate filtering on URL fields in various core components could lead to an XSS vulnerability.
CVE-2019-7742 1Joomla 1Joomla Jun 17, 2026 Feb 12, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Joomla! before 3.9.3. A combination of specific web server configurations, in connection with specific file types and browser-side MIME-type sniffing, causes an XSS attack vector.
CVE-2019-7741 1Joomla 1Joomla Jun 17, 2026 Feb 12, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Joomla! before 3.9.3. Inadequate checks at the Global Configuration helpurl settings allowed stored XSS.
CVE-2019-7740 1Joomla 1Joomla Jun 17, 2026 Feb 12, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Joomla! before 3.9.3. Inadequate parameter handling in JavaScript code (core.js writeDynaList) could lead to an XSS attack vector.
CVE-2019-7753 1Verydows 1Verydows Jun 17, 2026 Feb 12, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Verydows 2.0 has XSS via the index.php?m=api&c=stats&a=count referrer parameter.
CVE-2019-3923 1Tenable 1Nessus Jun 17, 2026 Feb 12, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Nessus versions 8.2.1 and earlier were found to contain a stored XSS vulnerability due to improper validation of user-supplied input. An authenticated, remote attacker could potentially exploit this vulnerability via a s...Show more Nessus versions 8.2.1 and earlier were found to contain a stored XSS vulnerability due to improper validation of user-supplied input. An authenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script code in a user's browser session. Tenable has released Nessus 8.2.2 to address this issue.Show less
CVE-2019-7748 1Dbninja 1Dbninja Jun 17, 2026 Feb 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 _includes\online.php in DbNinja 3.2.7 allows XSS via the data.php task parameter if _users/admin/tasks.php exists.
CVE-2018-20242 1Apache 1Jspwiki Nov 21, 2024 Feb 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking.
CVE-2018-20778 1Frog Cms Project 1Frog Cms Nov 21, 2024 Feb 11, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 admin/?/plugin/file_manager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element.
CVE-2018-20777 1Frog Cms Project 1Frog Cms Nov 21, 2024 Feb 11, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field.
CVE-2018-20774 1Frog Cms Project 1Frog Cms Nov 21, 2024 Feb 11, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field.
CVE-2019-7693 1Axiositalia 1Registro Elettronico Jun 17, 2026 Feb 10, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Axios Italia Axios RE 1.7.0/7.0.0 devices have XSS via the RELogOff.aspx Error_Parameters parameter. In some situations, the XSS would be on the family.axioscloud.it cloud service; however, the vendor also supports "Siss...Show more Axios Italia Axios RE 1.7.0/7.0.0 devices have XSS via the RELogOff.aspx Error_Parameters parameter. In some situations, the XSS would be on the family.axioscloud.it cloud service; however, the vendor also supports "Sissi in Rete (con server)" for offline operation.Show less
CVE-2019-7677 1Enphase 1Envoy Jun 17, 2026 Feb 9, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in Enphase Envoy R3.. via the profileName parameter to the /home URI on TCP port 8888.

Previous 1...191919201921...2447 Next