Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (48,952)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-1002008 1Kibokolabs 1Arigato Autoresponder And Newsletter Nov 21, 2024 Dec 3, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in list-user.html.php:4:...Show more There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in list-user.html.php:4: via GET request offset variable.Show less
CVE-2018-1002007 1Kibokolabs 1Arigato Autoresponder And Newsletter Nov 21, 2024 Dec 3, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in integration-contact-fo...Show more There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:15: via POST request variable html_id.Show less
CVE-2018-1002006 1Kibokolabs 1Arigato Autoresponder And Newsletter Nov 21, 2024 Dec 3, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:14: via POST request variable classes
CVE-2018-1002005 1Kibokolabs 1Arigato Autoresponder And Newsletter Nov 21, 2024 Dec 3, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in bft_list.html.php:43: via the filter_signup_date parameter.
CVE-2018-1002004 1Kibokolabs 1Arigato Autoresponder And Newsletter Nov 21, 2024 Dec 3, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
CVE-2018-1002003 1Kibokolabs 1Arigato Autoresponder And Newsletter Nov 21, 2024 Dec 3, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
CVE-2018-1002002 1Kibokolabs 1Arigato Autoresponder And Newsletter Nov 21, 2024 Dec 3, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
CVE-2018-1002001 1Kibokolabs 1Arigato Autoresponder And Newsletter Nov 21, 2024 Dec 3, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.
CVE-2018-19794 1Internet2 1Grouper Nov 21, 2024 Dec 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in UiV2Public.index in Internet2 Grouper 2.2 and 2.3 allows remote attackers to inject arbitrary web script or HTML via the code parameter.
CVE-2018-19787 3Canonical DebianLxml 3Debian Linux LxmlUbuntu Linux Dec 18, 2025 Dec 2, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j...Show more An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.Show less
CVE-2018-19785 1Php Proxy 1Php Proxy Nov 21, 2024 Dec 1, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 PHP-Proxy through 5.1.0 has Cross-Site Scripting (XSS) via the URL field in index.php.
CVE-2018-7831 1Schneider Electric 4Modicom Bmxnor0200h Firmware Modicom M340 FirmwareModicom Premium Firmware+1 more Jun 17, 2026 Nov 30, 2018 N/A· v4 8.8 HIGH· v3 4.3 MEDIUM· v2 An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a s...Show more An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted URL to a currently authenticated web server user to execute a password change on the web server.Show less
CVE-2018-7810 1Schneider Electric 4Modicom Bmxnor0200h Firmware Modicom M340 FirmwareModicom Premium Firmware+1 more Jun 17, 2026 Nov 30, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to c...Show more An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to craft a URL containing JavaScript that will be executed within the user's browser, potentially impacting the machine the browser is running on.Show less
CVE-2018-0716 1Qnap 1Qts Nov 21, 2024 Nov 30, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2, QTS 4.3.4: Qsync Central 3.0.3, QTS 4.3.5: Qsync Central 3.0.4 and earlier versions could allow remote attackers to inject J...Show more Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2, QTS 4.3.4: Qsync Central 3.0.3, QTS 4.3.5: Qsync Central 3.0.4 and earlier versions could allow remote attackers to inject Javascript code in the compromised application.Show less
CVE-2018-19527 1I4 1Ai Si Assistant Nov 21, 2024 Nov 29, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 i4 assistant 7.85 allows XSS via a crafted machine name field within iOS settings.
CVE-2018-19752 1Domainmod 1Domainmod Nov 21, 2024 Nov 29, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.
CVE-2018-19751 1Domainmod 1Domainmod Nov 21, 2024 Nov 29, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields.
CVE-2018-19750 1Domainmod 1Domainmod Nov 21, 2024 Nov 29, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields.
CVE-2018-19749 1Domainmod 1Domainmod Nov 21, 2024 Nov 29, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field.
CVE-2018-19693 1Tp5cms Project 1Tp5cms Nov 21, 2024 Nov 29, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the title parameter.

Previous 1...194019411942...2448 Next