← Back
CWE-79

48,928 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,928)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-0244
1Sap
3Customer Relationship Management Webclient Ui
S4fndSapscore
Jun 17, 2026
Jan 8, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVE-2019-0238
1Sap
1Hybris
Jun 17, 2026
Jan 8, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
SAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVE-2018-1918
1Ibm
1Jazz Reporting Service
Nov 21, 2024
Jan 8, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Jazz Reporting Service (JRS) 6.0.3, 6.0.4, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functiona...Show more
IBM Jazz Reporting Service (JRS) 6.0.3, 6.0.4, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152785.Show less
CVE-2019-5311
1Yunucms
1Yunucms
Jun 17, 2026
Jan 4, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in YUNUCMS V1.1.8. app/index/controller/Show.php has an XSS vulnerability via the index.php/index/show/index cw parameter.
CVE-2018-1951
1Ibm
1Engineering Lifecycle Optimization Publishing
Mar 25, 2025
Jan 4, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially l...Show more
IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153494.Show less
CVE-2018-1657
1Ibm
1Engineering Lifecycle Optimization Publishing
Mar 25, 2025
Jan 4, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially l...Show more
IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-force ID: 144883.Show less
CVE-2019-5310
1Yunucms
1Yunucms
Jun 17, 2026
Jan 4, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
YUNUCMS 1.1.8 has XSS in app/admin/controller/System.php because crafted data can be written to the sys.php file, as demonstrated by site_title in an admin/system/basic POST request.
CVE-2018-8827
1Technicolor
1Tg789vac Firmware
Jun 17, 2026
Jan 3, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The admin web interface on Technicolor MediaAccess TG789vac v2 HP devices with firmware v16.3.7190-2761005-20161004084353 displays unsanitised user input, which allows an unauthenticated malicious user to embed JavaScrip...Show more
The admin web interface on Technicolor MediaAccess TG789vac v2 HP devices with firmware v16.3.7190-2761005-20161004084353 displays unsanitised user input, which allows an unauthenticated malicious user to embed JavaScript into the Log viewer interface via a crafted HTTP Referer header, aka XSS.Show less
CVE-2018-18997
1Abb
2Gate E1 Firmware
Gate E2 Firmware
Nov 21, 2024
Jan 3, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Pluto Safety PLC Gateway Ethernet devices in ABB GATE-E1 and GATE-E2 all versions allows an unauthenticated attacker using the administrative web interface to insert an HTML/Javascript payload into any of the device prop...Show more
Pluto Safety PLC Gateway Ethernet devices in ABB GATE-E1 and GATE-E2 all versions allows an unauthenticated attacker using the administrative web interface to insert an HTML/Javascript payload into any of the device properties, which may allow an attacker to display/execute the payload in a visitor browser.Show less
CVE-2018-19600
1Rhymix
1Rhymix
Nov 21, 2024
Jan 3, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.
CVE-2018-18244
1Vivotek
1Camera
Nov 21, 2024
Jan 3, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting in syslog.html in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript code via an HTTP Referer Header.
CVE-2018-18005
1Vivotek
1Camera
Nov 21, 2024
Jan 3, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting in event_script.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript via a URL query string parameter.
CVE-2018-20663
1Haulmont
2Cuba Platform
Reporting
Nov 21, 2024
Jan 3, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The Reporting Addon (aka Reports Addon) through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the "Reports > Reports" name field.
CVE-2018-19995
1Dolibarr
1Dolibarr Erp/crm
Nov 21, 2024
Jan 3, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" (POST) or "town" (POST) parameter to user/card.php.
CVE-2018-19993
1Dolibarr
1Dolibarr Erp/crm
Nov 21, 2024
Jan 3, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A reflected cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote attackers to inject arbitrary web script or HTML via the transphrase parameter to public/notice.php.
CVE-2018-19992
1Dolibarr
1Dolibarr Erp/crm
Nov 21, 2024
Jan 3, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" (POST) or "town" (POST) parameter to adherents/type.php.
CVE-2018-19414
1Plikli
1Plikli Cms
Nov 21, 2024
Jan 3, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword parameter to groups.php; (2) username parameter to login.php; or (...Show more
Multiple cross-site scripting (XSS) vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword parameter to groups.php; (2) username parameter to login.php; or (3) date parameter to search.php.Show less
CVE-2018-14481
1Osclass
1Osclass
Nov 21, 2024
Jan 3, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280.
CVE-2018-20326
1Chinamobile
1Gpn2.4p21 C Cn Firmware
Nov 21, 2024
Jan 2, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have XSS via the cgi-bin/webproc?getpage=html/index.html var:subpage parameter.
CVE-2019-3501
1Ougc Awards Project
1Ougc Awards
Jun 17, 2026
Jan 2, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profile.