← Back
CWE-79

48,952 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,952)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-13312
1Totolink
1A3002ru Firmware
Nov 21, 2024
Nov 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "Input your notice URL" field.
CVE-2018-13310
1Totolink
1A3002ru Firmware
Nov 21, 2024
Nov 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username.
CVE-2018-13309
1Totolink
1A3002ru Firmware
Nov 21, 2024
Nov 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password.
CVE-2018-13308
1Totolink
1A3002ru Firmware
Nov 21, 2024
Nov 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "User phrases button" field.
CVE-2018-18807
1Tibco
1Statistica Server
Nov 21, 2024
Nov 26, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The web application of the TIBCO Statistica component of TIBCO Software Inc.'s TIBCO Statistica Server contains vulnerabilities which may allow an authenticated user to perform cross-site scripting (XSS) attacks. Affecte...Show more
The web application of the TIBCO Statistica component of TIBCO Software Inc.'s TIBCO Statistica Server contains vulnerabilities which may allow an authenticated user to perform cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Statistica Server versions up to and including 13.4.0.Show less
CVE-2018-19564
1Goldplugins
1Easy Testimonials
Nov 21, 2024
Nov 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters (_ikcf_client and _ikcf_position and _ikcf_other) have Cross-Site Scripting.
CVE-2018-19554
1Dotcms
1Dotcms
Nov 21, 2024
Nov 26, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in Dotcms through 5.0.3. Attackers may perform XSS attacks via the inode, identifier, or fieldName parameter in html/js/dotcms/dijit/image/image_tool.jsp.
CVE-2018-19547
1Jtbc
1Jtbc Php
Nov 21, 2024
Nov 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
JTBC(PHP) 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter.
CVE-2018-19546
1Jtbc
1Jtbc Php
Nov 21, 2024
Nov 26, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
JTBC(PHP) 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter.
CVE-2018-19469
1Articlecms Project
1Articlecms
Nov 21, 2024
Nov 23, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
ArticleCMS through 2017-02-19 has XSS via the /update_personal_infomation realname or email parameter.
CVE-2018-19464
1Dismall
1Discuz!
Nov 21, 2024
Nov 22, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Discuz! X3.4 allows XSS via admin.php because admincp/admincp_setting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code.
CVE-2018-19433
1Showdoc
1Showdoc
Nov 21, 2024
Nov 22, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $cur_lang value.
CVE-2018-18864
1Loadbalancer
1Enterprise Va Max
Nov 21, 2024
Nov 20, 2018
N/A· v4
9.6 CRITICAL· v3
9.3 HIGH· v2
Loadbalancer.org Enterprise VA MAX before 8.3.3 has XSS because Apache HTTP Server logs are displayed.
CVE-2018-18774
1Control Webpanel
1Webpanel
Nov 21, 2024
Nov 20, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter.
CVE-2018-18716
1Zohocorp
1Manageengine Opmanager
Nov 21, 2024
Nov 20, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Zoho ManageEngine OpManager 12.3 before 123219 has a Self XSS Vulnerability.
CVE-2018-18715
1Zohocorp
1Manageengine Opmanager
Nov 21, 2024
Nov 20, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Zoho ManageEngine OpManager 12.3 before 123219 has stored XSS.
CVE-2018-19352
1Jupyter
1Notebook
Nov 21, 2024
Nov 18, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely.
CVE-2018-19351
1Jupyter
1Notebook
Nov 21, 2024
Nov 18, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript wit...Show more
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.Show less
CVE-2018-19350
1Seacms
1Seacms
Nov 21, 2024
Nov 17, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element.
CVE-2018-19340
1Guriddo
1Form Php
Nov 21, 2024
Nov 17, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Guriddo Form PHP 5.3 has XSS via the demos/jqform/defaultnodb/default.php OrderID, ShipName, ShipAddress, ShipCity, ShipPostalCode, ShipCountry, Freight, or details parameter.