CWE-79
48,952 CVEs • Abstraction: Base • Likelihood of Exploit: High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVEs (48,952)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Sap 1Businessobjects Bi Platform Nov 21, 2024 Nov 13, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 SAP BusinessObjects Business Intelligence Platform (BIWorkspace), versions 4.1 and 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. |
1Redhat 2Keycloak Single Sign OnNov 21, 2024 Nov 13, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows...Show more |
An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/art.php?typeid=1 biaoti parameter. |
An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/liuyan.php neirong[] parameter. |
An issue was discovered in LAOBANCMS 2.0. It allows XSS via the first input field to the admin/type.php?id=1 URI. |
An issue was discovered in LAOBANCMS 2.0. It allows a /install/mysql_hy.php?riqi=0&i=0 attack to reset the admin password, even if install.txt exists. |
2Debian Roundcube2Debian Linux WebmailNov 21, 2024 Nov 12, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment. |
1Ibm 1Websphere Application Server Nov 21, 2024 Nov 12, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality pot...Show more |
An issue was discovered in XiaoCms 20141229. There is XSS related to the template\default\show_product.html file. |
An issue was discovered in XiaoCms 20141229. There is XSS via the largest input box on the "New news" screen. |
In JEESNS 1.3, com/lxinet/jeesns/core/utils/XssHttpServletRequestWrapper.java allows stored XSS via an HTML EMBED element, a different vulnerability than CVE-2018-17886. |
In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the web_name parameter. |
1Otrs 1Open Ticket Request System Nov 21, 2024 Nov 11, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Open Ticket Request System (OTRS) 6.0.x before 6.0.13 allows an admin to conduct an XSS attack via a modified URL. |
2Debian Otrs2Debian Linux Open Ticket Request SystemNov 21, 2024 Nov 11, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Open Ticket Request System (OTRS) 4.0.x before 4.0.33 and 5.0.x before 5.0.31 allows an admin to conduct an XSS attack via a modified URL because user and customer preferences are mishandled. |
An issue was discovered in S-CMS v1.5. There is an XSS vulnerability in search.php via the keyword parameter. |
DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter. |
DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter. |
IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cred...Show more |
Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors. |
A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management...Show more |