← Back
CWE-79

48,928 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,928)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-6333
1Facebook
1Nuclide
Jun 17, 2026
Dec 31, 2018
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malicious URL could be used to render HTML and other content inside of the editor's co...Show more
The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malicious URL could be used to render HTML and other content inside of the editor's context, which could potentially be chained to lead to code execution. This issue affected Nuclide prior to v0.290.0.Show less
CVE-2018-6341
1Facebook
1React
Jun 17, 2026
Dec 31, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue...Show more
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.Show less
CVE-2018-19918
1Cuppacms
1Cuppacms
May 6, 2025
Dec 31, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
CuppaCMS has XSS via an SVG document uploaded to the administrator/#/component/table_manager/view/cu_views URI.
CVE-2018-19906
1Razorcms
1Razorcms
May 6, 2025
Dec 31, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.
CVE-2018-19905
1Razorcms
1Razorcms
May 6, 2025
Dec 31, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.
CVE-2018-19904
1Xsltcms.org Project
1Xsltcms.org
May 6, 2025
Dec 31, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field.
CVE-2018-19903
1Xsltcms.org Project
1Xsltcms.org
Nov 21, 2024
Dec 31, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field.
CVE-2018-19902
1No Cms Project
1No Cms
Nov 21, 2024
Dec 31, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article "keyword" parameter.
CVE-2018-19901
1No Cms Project
1No Cms
Nov 21, 2024
Dec 31, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article/index/ "article_title" parameter.
CVE-2018-19845
1Get Simple
1Getsimple Cms
Nov 21, 2024
Dec 31, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
There is Stored XSS in GetSimple CMS 3.3.12 via the admin/edit.php "post-menu" parameter, a related issue to CVE-2018-16325.
CVE-2018-19844
1Frogcms Project
1Frogcms
Nov 21, 2024
Dec 31, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
FROG CMS 0.9.5 has XSS via the admin/?/snippet/add name parameter, which is mishandled during an edit action, a related issue to CVE-2018-10319.
CVE-2018-20611
1Txjia
1Imcat
Nov 21, 2024
Dec 30, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
imcat 4.4 allow XSS via a crafted cookie to the root/tools/adbug/binfo.php?cookie URI.
CVE-2018-20601
1Ucms Project
1Ucms
Nov 21, 2024
Dec 30, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
UCMS 1.4.7 has XSS via the description parameter in an index.php list_editpost action.
CVE-2018-20600
1Ucms Project
1Ucms
Nov 21, 2024
Dec 30, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmin_cedit action.
CVE-2018-20597
1Ucms Project
1Ucms
Nov 21, 2024
Dec 30, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
UCMS 1.4.7 has XSS via the dir parameter in an index.php sadmin_fileedit action.
CVE-2018-20594
1Hsweb
1Hsweb
Nov 21, 2024
Dec 30, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in hsweb 3.0.4. It is a reflected XSS vulnerability due to the absence of type parameter checking in FlowableModelManagerController.java.
CVE-2018-20590
1Generic Content Management System Project
1Generic Content Management System
Nov 21, 2024
Dec 30, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 has XSS via the Administrator/users.php user ID.
CVE-2018-20589
1Generic Content Management System Project
1Generic Content Management System
Nov 21, 2024
Dec 30, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 has XSS via the Administrator/add_pictures.php article ID.
CVE-2018-20583
1Thephpleague
1Commonmark
Nov 21, 2024
Dec 30, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allow_unsafe_links is false) via...Show more
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allow_unsafe_links is false) via a newline character (e.g., writing javascript as javascri%0apt).Show less
CVE-2018-16638
1Modx
1Evolution Cms
Nov 21, 2024
Dec 28, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Evolution CMS 1.4.x allows XSS via the manager/ search parameter.