← Back
CWE-79

45,916 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (45,916)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2016-10366
1Elastic
1Kibana
May 13, 2026
Jun 16, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Kibana versions after and including 4.3 and before 4.6.2 are vulnerable to a cross-site scripting (XSS) attack.
CVE-2016-1000220
1Elastic
1Kibana
May 13, 2026
Jun 16, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers.
CVE-2015-9056
1Elastic
1Kibana
May 13, 2026
Jun 16, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Kibana versions prior to 4.1.3 and 4.2.1 are vulnerable to a XSS attack.
CVE-2017-9419
1Webhammer
1Wp Custom Fields Search
May 13, 2026
Jun 15, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inject arbitrary JavaScript via the cs-all-0 parameter.
CVE-2017-9674
1Simplece
1Simplece
May 13, 2026
Jun 15, 2017
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
In SimpleCE 2.3.0, an authenticated XSS vulnerability was found on index.php/content/text/1?return_url=[XSS] exploitable as a regular or admin user.
CVE-2017-9613
1Sap
1Successfactors
May 13, 2026
Jun 15, 2017
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Stored Cross-site scripting (XSS) vulnerability in SAP SuccessFactors before b1705.1234962 allows remote authenticated users to inject arbitrary web script or HTML via the file upload functionality.
CVE-2017-8551
1Microsoft
1Project Server
May 13, 2026
Jun 15, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An elevation of privilege vulnerability exists when Microsoft SharePoint software fails to properly sanitize a specially crafted requests, aka "Microsoft SharePoint XSS vulnerability".
CVE-2017-8550
1Microsoft
1Office
May 13, 2026
Jun 15, 2017
N/A· v4
5.4 MEDIUM· v3
4.3 MEDIUM· v2
A remote code execution vulnerability exists in Skype for Business when the software fails to sanitize specially crafted content, aka "Skype for Business Remote Code Execution Vulnerability".
CVE-2017-8514
1Microsoft
1Sharepoint Enterprise Server
May 13, 2026
Jun 15, 2017
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An information disclosure vulnerability exists when Microsoft SharePoint software fails to properly sanitize a specially crafted requests, aka "Microsoft SharePoint Reflective XSS Vulnerability".
CVE-2017-9624
1Epesi
1Epesi
May 13, 2026
Jun 14, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in Telaxus/EPESI 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted currency decimal-sign data.
CVE-2017-9623
1Epesi
1Epesi
May 13, 2026
Jun 14, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in Telaxus/EPESI 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted country data.
CVE-2017-9622
1Epesi
1Epesi
May 13, 2026
Jun 14, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in Telaxus/EPESI 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted common data.
CVE-2017-9621
1Epesi
1Epesi
May 13, 2026
Jun 14, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in modules/Base/Lang/Administrator/update_translation.php in EPESI in Telaxus/EPESI 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) or...Show more
Cross-site scripting (XSS) vulnerability in modules/Base/Lang/Administrator/update_translation.php in EPESI in Telaxus/EPESI 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) original or (2) new parameter.Show less
CVE-2016-8751
1Apache
1Ranger
May 13, 2026
Jun 14, 2017
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access...Show more
Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies.Show less
CVE-2017-1104
1Ibm
1Rational Quality Manager
May 13, 2026
Jun 13, 2017
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lea...Show more
IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120666.Show less
CVE-2017-1102
1Ibm
1Rational Quality Manager
May 13, 2026
Jun 13, 2017
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lea...Show more
IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120663.Show less
CVE-2017-1101
1Ibm
1Rational Quality Manager
May 13, 2026
Jun 13, 2017
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lea...Show more
IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120662.Show less
CVE-2017-1100
1Ibm
1Rational Quality Manager
May 13, 2026
Jun 13, 2017
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lea...Show more
IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120661.Show less
CVE-2016-9973
1Ibm
7Rational Collaborative Lifecycle Management
Rational Doors Next GenerationRational Engineering Lifecycle Manager+4 more
May 13, 2026
Jun 13, 2017
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disc...Show more
IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120209.Show less
CVE-2017-6675
1Cisco
1Industrial Network Director
May 13, 2026
Jun 13, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A vulnerability in the web interface of Cisco Industrial Network Director could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against an affected system. More Informat...Show more
A vulnerability in the web interface of Cisco Industrial Network Director could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against an affected system. More Information: CSCvd25405. Known Affected Releases: 1.1(0.176).Show less