Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,952)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-1671 1Ibm 1Curam Social Program Management Nov 21, 2024 Dec 10, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Curam Social Program Management 7.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context...Show more IBM Curam Social Program Management 7.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-force ID: 144951.Show less
CVE-2018-20017 1Sem Cms 1Semcms Nov 21, 2024 Dec 10, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 SEMCMS 3.5 has XSS via the first text box to the SEMCMS_Main.php URI.
CVE-2018-20012 1Phpcmf 1Phpcmf Nov 21, 2024 Dec 10, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI.
CVE-2018-20011 1Domainmod 1Domainmod Nov 21, 2024 Dec 10, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field.
CVE-2018-20010 1Domainmod 1Domainmod Nov 21, 2024 Dec 10, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field.
CVE-2018-20009 1Domainmod 1Domainmod Nov 21, 2024 Dec 10, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL field.
CVE-2018-20006 1Phpok 1Phpok Nov 21, 2024 Dec 10, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in PHPok v5.0.055. There is a Stored XSS vulnerability via the title parameter to api.php?c=post&f=save (reachable via the index.php?id=book URI).
CVE-2018-16861 1Theforeman 1Foreman Nov 21, 2024 Dec 7, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attac...Show more A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Foreman before 1.18.3, 1.19.1, and 1.20.0 are vulnerable.Show less
CVE-2018-19927 1Zenitel 1Ip Stationweb Firmware Nov 21, 2024 Dec 6, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zForm_save_changes sip_nick parameter. The password of alphaadmin for the a...Show more Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zForm_save_changes sip_nick parameter. The password of alphaadmin for the admin account may be used for authentication in some cases.Show less
CVE-2018-19926 1Zenitel 1Ip Stationweb Firmware Nov 21, 2024 Dec 6, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Zenitel Norway IP-StationWeb before 4.2.3.9 allows reflected XSS via the goform/ PATH_INFO.
CVE-2018-19924 1Sales & Company Management System Project 1Sales & Company Management System Nov 21, 2024 Dec 6, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. An email address can be modified in between the request for a validation code and the entry of the validation code, leading to stora...Show more An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. An email address can be modified in between the request for a validation code and the entry of the validation code, leading to storage of an XSS payload contained in the modified address.Show less
CVE-2018-19922 1Actiontec 1C1000a Firmware Nov 21, 2024 Dec 6, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Persistent Cross-Site Scripting (XSS) in the advancedsetup_websiteblocking.html Website Blocking page of the Actiontec C1000A router with firmware through CAC004-31.30L.95 allows a remote attacker to inject arbitrary HTM...Show more Persistent Cross-Site Scripting (XSS) in the advancedsetup_websiteblocking.html Website Blocking page of the Actiontec C1000A router with firmware through CAC004-31.30L.95 allows a remote attacker to inject arbitrary HTML into the Website Blocking page by inserting arbitrary HTML into the 'TodUrlAdd' URL parameter in a /urlfilter.cmd POST request.Show less
CVE-2018-19921 1Zohocorp 1Manageengine Opmanager Nov 21, 2024 Dec 6, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller.
CVE-2018-19919 1Pixelimity 1Pixelimity Nov 21, 2024 Dec 6, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Pixelimity 1.0 has Persistent XSS via the admin/portfolio.php data[title] parameter, as demonstrated by a crafted onload attribute of an SVG element.
CVE-2018-19915 1Domainmod 1Domainmod Nov 21, 2024 Dec 6, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.
CVE-2018-19914 1Domainmod 1Domainmod Nov 21, 2024 Dec 6, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field.
CVE-2018-19913 1Domainmod 1Domainmod Nov 21, 2024 Dec 6, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.
CVE-2018-18362 1Symantec 1Norton Password Manager Nov 21, 2024 Dec 6, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Norton Password Manager for Android (formerly Norton Identity Safe) may be susceptible to a cross site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pa...Show more Norton Password Manager for Android (formerly Norton Identity Safe) may be susceptible to a cross site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.Show less
CVE-2018-1871 1Ibm 1Financial Transaction Manager Nov 21, 2024 Dec 6, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.0, 3.0.2, and 3.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI th...Show more IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.0, 3.0.2, and 3.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 151329.Show less
CVE-2018-19892 1Domainmod 1Domainmod Nov 21, 2024 Dec 6, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName field.

Previous 1...193819391940...2448 Next