← Back
CWE-79

48,952 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (48,952)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-15969
1Adobe
1Experience Manager
Nov 21, 2024
Oct 17, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2018-18373
1Schiocco
1Support Board Chat And Help Desk
Nov 21, 2024
Oct 17, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file upload areas in the Chat and Help Desk sections via the msg parameter in a /wp-admin...Show more
In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file upload areas in the Chat and Help Desk sections via the msg parameter in a /wp-admin/admin-ajax.php sb_ajax_add_message action.Show less
CVE-2018-18372
1Kaasoft
1Library Cms
Nov 21, 2024
Oct 17, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A Stored XSS vulnerability has been discovered in KAASoft Library CMS - Powerful Book Management System 2.1.1 via the /admin/book/create/ title parameter.
CVE-2018-18262
1Zohocorp
1Manageengine Opmanager
Nov 21, 2024
Oct 17, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Zoho ManageEngine OpManager 12.3 before build 123214 has XSS.
CVE-2018-17964
1Aryanic
1Highportal
Nov 21, 2024
Oct 17, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Aryanic HighPortal 12.5 has XSS via an Add Tags action.
CVE-2018-18433
1Destoon
1Destoon B2b
Nov 21, 2024
Oct 17, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in DESTOON B2B 7.0. admin/category.inc.php has XSS via the category[catname] parameter to the admin.php URI.
CVE-2018-18431
1Destoon
1Destoon B2b
Nov 21, 2024
Oct 17, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in DESTOON B2B 7.0. XSS exists via certain text boxes to the admin.php?moduleid=2&action=add URI.
CVE-2018-18430
1Destoon
1Destoon B2b
Nov 21, 2024
Oct 17, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI.
CVE-2018-18308
1Bigtreecms
1Bigtree Cms
Nov 21, 2024
Oct 16, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (aka the image upload area).
CVE-2018-18307
1Alchemy Cms
1Alchemy Cms
Aug 29, 2025
Oct 16, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field. NOTE: the vendor's position is that this is not a valid report: "The researcher used an authorized cookie...Show more
A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field. NOTE: the vendor's position is that this is not a valid report: "The researcher used an authorized cookie to perform the request to a password-protected route. Without that session cookie, the request would have been rejected as unauthorized."Show less
CVE-2018-1777
1Ibm
1Websphere Application Server
Nov 21, 2024
Oct 16, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality pot...Show more
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148800.Show less
CVE-2018-18381
1Zblogcn
1Z Blogphp
Nov 21, 2024
Oct 16, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18374
1Metinfo
1Metinfo
Nov 21, 2024
Oct 16, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.
CVE-2018-18260
1Tuzitio
1Camaleon Cms
Nov 21, 2024
Oct 15, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false. NOTE: the vendor reports th...Show more
In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false. NOTE: the vendor reports that they are "unable to reproduce the reported issue on any version."Show less
CVE-2018-18259
1Luya
1Luya Cms
Nov 21, 2024
Oct 15, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Stored XSS has been discovered in version 1.0.12 of the LUYA CMS software via /admin/api-cms-nav/create-page.
CVE-2018-17533
1Teltonika
3Rut900 Firmware
Rut950 FirmwareRut955 Firmware
Nov 21, 2024
Oct 15, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Teltonika RUT9XX routers with firmware before 00.05.01.1 are prone to cross-site scripting vulnerabilities in hotspotlogin.cgi due to insufficient user input sanitization.
CVE-2018-15538
1Agentejo
1Cockpit
Nov 21, 2024
Oct 15, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Agentejo Cockpit has multiple Cross-Site Scripting vulnerabilities.
CVE-2017-5934
4Canonical
DebianMoinmo+1 more
4Debian Linux
LeapMoinmoin+1 more
Nov 21, 2024
Oct 15, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-18361
1Nconsulting
1Nc Cms
Nov 21, 2024
Oct 15, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in nc-cms through 2017-03-10. index.php?action=edit_html allows XSS via the name parameter, as demonstrated by a value beginning with home_content and containing a crafted SRC attribute of an IMG...Show more
An issue was discovered in nc-cms through 2017-03-10. index.php?action=edit_html allows XSS via the name parameter, as demonstrated by a value beginning with home_content and containing a crafted SRC attribute of an IMG element.Show less
CVE-2018-18324
1Control Webpanel
1Webpanel
Nov 21, 2024
Oct 15, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter, or the admin/index.php module, service_start, service_fullstatus, service_restart, service_stop, o...Show more
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter, or the admin/index.php module, service_start, service_fullstatus, service_restart, service_stop, or file (within the file_editor) parameter.Show less