← Back
CWE-79

48,952 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,952)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2017-1609
1Ibm
1Rational Quality Manager
Nov 21, 2024
Nov 2, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Quality Manager (RQM) 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functi...Show more
IBM Quality Manager (RQM) 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132929.Show less
CVE-2018-6906
1Rainmachine
1Rainmachine Web Application
Jun 17, 2026
Nov 1, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A persistent Cross Site Scripting (XSS) vulnerability in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application allows an attacker to inject arbitrary JavaScript via the REST API.
CVE-2018-18776
1Microstrategy
1Microstrategy Web
Nov 21, 2024
Nov 1, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the admin/admin.asp ShowAll parameter. NOTE: this is a deprecated product.
CVE-2018-18775
1Microstrategy
1Microstrategy Web
Nov 21, 2024
Nov 1, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the Login.asp Msg parameter. NOTE: this is a deprecated product.
CVE-2018-10586
1Netgain Systems
1Enterprise Manager
Nov 21, 2024
Nov 1, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
NetGain Enterprise Manager (EM) is affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities in versions before 10.1.12.
CVE-2018-15707
1Advantech
1Webaccess
Nov 21, 2024
Oct 31, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other things.
CVE-2016-6343
1Redhat
1Jboss Bpm Suite
Nov 21, 2024
Oct 31, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. Remote attackers can entice authenticated users that have privileges to access dashbuilder (usually admins) to click on links to /dashbuilder/Controller...Show more
JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. Remote attackers can entice authenticated users that have privileges to access dashbuilder (usually admins) to click on links to /dashbuilder/Controller containing malicious scripts. Successful exploitation would allow execution of script code within the context of the affected user.Show less
CVE-2018-18868
1No Cms Project
1No Cms
Nov 21, 2024
Oct 31, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
No-CMS 1.1.3 is prone to Persistent XSS via a contact_us name parameter, as demonstrated by the VG48Z5PqVWname parameter.
CVE-2018-16468
2Debian
Loofah Project
2Debian Linux
Loofah
Nov 21, 2024
Oct 30, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
CVE-2018-17783
1Mantisbt
1Mantisbt
Nov 21, 2024
Oct 30, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A cross-site scripting (XSS) vulnerability in the Edit Filter page (manage_filter_edit page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP sett...Show more
A cross-site scripting (XSS) vulnerability in the Edit Filter page (manage_filter_edit page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP settings permit it) through a crafted project name.Show less
CVE-2018-17782
1Mantisbt
1Mantisbt
Nov 21, 2024
Oct 30, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A cross-site scripting (XSS) vulnerability in the Manage Filters page (manage_filter_page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP settin...Show more
A cross-site scripting (XSS) vulnerability in the Manage Filters page (manage_filter_page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP settings permit it) through a crafted project name.Show less
CVE-2018-18841
1Sem Cms
1Semcms
Nov 21, 2024
Oct 30, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
XSS was discovered in SEMCMS PHP V3.4 via the SEMCMS_SeoAndTag.php?Class=edit&CF=SeoAndTag tag_indexkey parameter.
CVE-2018-18840
1Sem Cms
1Semcms
Nov 21, 2024
Oct 30, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
XSS was discovered in SEMCMS PHP V3.4 via the SEMCMS_SeoAndTag.php?Class=edit&CF=SeoAndTag tag_indexmetatit parameter.
CVE-2018-18825
1Pagoda Linux Project
1Pagoda Linux
Nov 21, 2024
Oct 30, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login. A crafted code is mishandled during rendering of the login log.
CVE-2018-1767
1Ibm
1Websphere Application Server
Nov 21, 2024
Oct 29, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Cachemonitor is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended func...Show more
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Cachemonitor is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148621.Show less
CVE-2018-1766
1Ibm
1Rational Team Concert
Nov 21, 2024
Oct 29, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Team Concert (RTC) 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functiona...Show more
IBM Team Concert (RTC) 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148620.Show less
CVE-2018-18783
1Sem Cms
1Semcms
Nov 21, 2024
Oct 29, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
XSS was discovered in SEMCMS V3.4 via the semcms_remail.php?type=ok umail parameter.
CVE-2018-18782
1Dedecms
1Dedecms
Nov 21, 2024
Oct 29, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter.
CVE-2018-18781
1Dedecms
1Dedecms
Nov 21, 2024
Oct 29, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter.
CVE-2018-18745
1Sem Cms
1Semcms
Nov 21, 2024
Oct 29, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS_Menu.php?lgid=1 during editing.