CWE-79
49,082 CVEs • Abstraction: Base • Likelihood of Exploit: High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVEs (49,082)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
The Jibu Pro plugin through 1.7 for WordPress is prone to Stored XSS via the wp-content/plugins/jibu-pro/quiz_action.php name (aka Quiz Name) field. |
PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header, |
A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode. |
App/Modules/Admin/Tpl/default/Public/dwz/uploadify/scripts/uploadify.swf in EasyCMS 1.5 has XSS via the uploadifyID or movieName parameter, a related issue to CVE-2018-9173. |
An issue was discovered in DonLinkage 6.6.8. The modules /pages/bazy/bazy_adresow.php and /pages/proxy/add.php are vulnerable to stored XSS that can be triggered by closing <textarea> followed by <script></script> tags. |
An issue was discovered in OTCMS 3.61. XSS exists in admin/share_switch.php via these parameters: fieldName fieldName2 tabName. |
An issue was discovered in OTCMS 3.61. XSS exists in admin/users.php via these parameters: dataTypeCN dataMode dataModeStr. |
An issue was discovered in SeaCMS 6.64. XSS exists in admin_video.php via the action, area, type, yuyan, jqtype, v_isunion, v_recycled, v_ismoney, or v_ispsd parameter. |
3Debian NetappPhp3Debian Linux PhpStorage Automation StoreNov 21, 2024 Sep 16, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in...Show more |
An issue was discovered in yiqicms through 2016-11-20. There is stored XSS in comment.php because a length limit can be bypassed. |
BullGuard Safe Browsing before 18.1.355.9 allows XSS on Google, Bing, and Yahoo! pages via domains indexed in search results. |
Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields in the Partial Branding configuration page. |
1Knet 1Cisco Configuration Manager Nov 21, 2024 Sep 14, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 K-Net Cisco Configuration Manager through 2014-11-19 has XSS via devices.php. |
1Cqu Lankers Project 1Cqu Lankers Nov 21, 2024 Sep 14, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 CQU-LANKERS through 2017-11-02 has XSS via the public/api.php callback parameter in an uploadpic action. |
1Translate Man Project 1Translate Man Nov 21, 2024 Sep 14, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 translate man before 2018-08-21 has XSS via containers/outputBox/outputBox.vue and store/index.js. |
In YzmCMS 5.1, stored XSS exists via the admin/system_manage/user_config_add.html title parameter. |
MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $_SERVER['REQUEST_URI'] is mishandled. |
UCMS 1.4.6 has XSS via the install/index.php mysql_dbname parameter. |
In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent. |
admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page&name=error404 action, a different vulnerability than CVE-2018-10121. |