Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (45,916)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-2168 1Wpbookingsystem 1Wp Booking System May 13, 2026 May 22, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web script or HTML via unsp...Show more Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.Show less
CVE-2016-4903 1Wp Olivecart 2Olivecart Olivecartpro May 13, 2026 May 22, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-9140 1Progress 2Sitefinity Cms Telerik Reporting May 13, 2026 May 22, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary w...Show more Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd.Show less
CVE-2017-2549 1Apple 3Iphone Os SafariTvos May 13, 2026 May 22, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to...Show more An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with frame loading.Show less
CVE-2017-2528 1Apple 2Iphone Os Safari May 13, 2026 May 22, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) at...Show more An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with cached frames.Show less
CVE-2017-2510 1Apple 2Iphone Os Safari May 13, 2026 May 22, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) at...Show more An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with pageshow events.Show less
CVE-2017-2508 1Apple 2Iphone Os Safari May 13, 2026 May 22, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) at...Show more An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with container nodes.Show less
CVE-2017-2504 1Apple 3Iphone Os SafariTvos May 13, 2026 May 22, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to...Show more An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with WebKit Editor commands.Show less
CVE-2017-6654 1Cisco 1Unified Communications Manager May 13, 2026 May 22, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in the web-based management interface of Cisco Unified Communications Manager 10.5 through 11.5 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a use...Show more A vulnerability in the web-based management interface of Cisco Unified Communications Manager 10.5 through 11.5 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvc06608.Show less
CVE-2017-4978 1Rsa 1Adaptive Authentication (on Premise) May 13, 2026 May 19, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 EMC RSA Adaptive Authentication (On-Premise) versions prior to 7.3 P2 (exclusive) contains a fix for a cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected...Show more EMC RSA Adaptive Authentication (On-Premise) versions prior to 7.3 P2 (exclusive) contains a fix for a cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.Show less
CVE-2017-9072 1Calendarxp 2Flatcalendarxp Popcalendarxp May 13, 2026 May 18, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Two CalendarXP products have XSS in common parts of HTML files. CalendarXP FlatCalendarXP through 9.9.290 has XSS in iflateng.htm and nflateng.htm. CalendarXP PopCalendarXP through 9.8.308 has XSS in ipopeng.htm and npop...Show more Two CalendarXP products have XSS in common parts of HTML files. CalendarXP FlatCalendarXP through 9.9.290 has XSS in iflateng.htm and nflateng.htm. CalendarXP PopCalendarXP through 9.8.308 has XSS in ipopeng.htm and npopeng.htm.Show less
CVE-2017-9071 1Modx 1Modx Revolution May 13, 2026 May 18, 2017 N/A· v4 4.7 MEDIUM· v3 2.6 LOW· v2 In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning.
CVE-2017-9070 1Modx 1Modx Revolution May 13, 2026 May 18, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php.
CVE-2017-9068 1Modx 1Modx Revolution May 13, 2026 May 18, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the database_type parameter.
CVE-2017-9063 2Debian Wordpress 2Debian Linux Wordpress May 13, 2026 May 18, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.
CVE-2017-9062 2Debian Wordpress 2Debian Linux Wordpress May 13, 2026 May 18, 2017 N/A· v4 8.6 HIGH· v3 5.0 MEDIUM· v2 In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
CVE-2017-9061 2Debian Wordpress 2Debian Linux Wordpress May 13, 2026 May 18, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename.
CVE-2017-4011 1Mcafee 1Network Data Loss Prevention May 13, 2026 May 17, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get session/cookie information via modification of the HTTP request.
CVE-2015-3998 2Clickfraud Monitoring Phpwhois Project 2Adsense Click Fraud Monitoring Phpwhois May 13, 2026 May 17, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers to inject arbitrary web script or HTML via the query parameter...Show more Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers to inject arbitrary web script or HTML via the query parameter to whois.php.Show less
CVE-2017-7953 1Infor 1Enterprise Asset Management May 13, 2026 May 16, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 INFOR EAM V11.0 Build 201410 has XSS via comment fields.

Previous 1...192619271928...2296 Next