Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (49,082)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-15312 1F5 13Big Ip Access Policy Manager Big Ip Advanced Firewall ManagerBig Ip Analytics+10 more Nov 21, 2024 Oct 19, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an authenticated user to execute JavaSc...Show more On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an authenticated user to execute JavaScript for the currently logged-in user.Show less
CVE-2015-4631 1Koha 1Koha Nov 21, 2024 Oct 18, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to inject arbitrary web script or HTML via...Show more Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to inject arbitrary web script or HTML via the (1) tag parameter to opac-search.pl; the (2) value parameter to authorities/authorities-home.pl; the (3) delay parameter to acqui/lateorders.pl; the (4) authtypecode or (5) tagfield to admin/auth_subfields_structure.pl; the (6) tagfield parameter to admin/marc_subfields_structure.pl; the (7) limit parameter to catalogue/search.pl; the (8) bookseller_filter, (9) callnumber_filter, (10) EAN_filter, (11) ISSN_filter, (12) publisher_filter, or (13) title_filter parameter to serials/serials-search.pl; or the (14) author, (15) collectiontitle, (16) copyrightdate, (17) isbn, (18) manageddate_from, (19) manageddate_to, (20) publishercode, (21) suggesteddate_from, or (22) suggesteddate_to parameter to suggestion/suggestion.pl; or the (23) direction, (24) display or (25) addshelf parameter to opac-shelves.pl.Show less
CVE-2018-18478 1Librenms 1Librenms Nov 21, 2024 Oct 18, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Persistent Cross-Site Scripting (XSS) issues in LibreNMS before 1.44 allow remote attackers to inject arbitrary web script or HTML via the dashboard_name parameter in the /ajax_form.php resource, related to html/includes...Show more Persistent Cross-Site Scripting (XSS) issues in LibreNMS before 1.44 allow remote attackers to inject arbitrary web script or HTML via the dashboard_name parameter in the /ajax_form.php resource, related to html/includes/forms/add-dashboard.inc.php, html/includes/forms/delete-dashboard.inc.php, and html/includes/forms/edit-dashboard.inc.php.Show less
CVE-2018-18460 13cx 1Live Chat Nov 21, 2024 Oct 18, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page request.
CVE-2018-15435 1Cisco 1Socialminer Nov 21, 2024 Oct 17, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in the web-based management interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management...Show more A vulnerability in the web-based management interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information.Show less
CVE-2018-0388 1Cisco 1Wireless Lan Controller Software Nov 21, 2024 Oct 17, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 A vulnerability in the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web-based in...Show more A vulnerability in the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web-based interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information.Show less
CVE-2018-15973 1Adobe 1Experience Manager Nov 21, 2024 Oct 17, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2018-15972 1Adobe 1Experience Manager Nov 21, 2024 Oct 17, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2018-15971 1Adobe 1Experience Manager Nov 21, 2024 Oct 17, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2018-15970 1Adobe 1Experience Manager Nov 21, 2024 Oct 17, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2018-15969 1Adobe 1Experience Manager Nov 21, 2024 Oct 17, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2018-18373 1Schiocco 1Support Board Chat And Help Desk Nov 21, 2024 Oct 17, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file upload areas in the Chat and Help Desk sections via the msg parameter in a /wp-admin...Show more In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file upload areas in the Chat and Help Desk sections via the msg parameter in a /wp-admin/admin-ajax.php sb_ajax_add_message action.Show less
CVE-2018-18372 1Kaasoft 1Library Cms Nov 21, 2024 Oct 17, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Stored XSS vulnerability has been discovered in KAASoft Library CMS - Powerful Book Management System 2.1.1 via the /admin/book/create/ title parameter.
CVE-2018-18262 1Zohocorp 1Manageengine Opmanager Nov 21, 2024 Oct 17, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Zoho ManageEngine OpManager 12.3 before build 123214 has XSS.
CVE-2018-17964 1Aryanic 1Highportal Nov 21, 2024 Oct 17, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Aryanic HighPortal 12.5 has XSS via an Add Tags action.
CVE-2018-18433 1Destoon 1Destoon B2b Nov 21, 2024 Oct 17, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in DESTOON B2B 7.0. admin/category.inc.php has XSS via the category[catname] parameter to the admin.php URI.
CVE-2018-18431 1Destoon 1Destoon B2b Nov 21, 2024 Oct 17, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in DESTOON B2B 7.0. XSS exists via certain text boxes to the admin.php?moduleid=2&action=add URI.
CVE-2018-18430 1Destoon 1Destoon B2b Nov 21, 2024 Oct 17, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI.
CVE-2018-18308 1Bigtreecms 1Bigtree Cms Nov 21, 2024 Oct 16, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (aka the image upload area).
CVE-2018-18307 1Alchemy Cms 1Alchemy Cms Aug 29, 2025 Oct 16, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field. NOTE: the vendor's position is that this is not a valid report: "The researcher used an authorized cookie...Show more A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field. NOTE: the vendor's position is that this is not a valid report: "The researcher used an authorized cookie to perform the request to a password-protected route. Without that session cookie, the request would have been rejected as unauthorized."Show less

Previous 1...195719581959...2455 Next