Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (49,082)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-16776 1Creatiwity 1Witycms Nov 21, 2024 Sep 10, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 wityCMS 0.6.2 has XSS via the "Site Name" field found in the "Contact" "Configuration" page.
CVE-2018-16775 1Victor Cms Project 1Victor Cms Nov 21, 2024 Sep 10, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the site name in the "Categories" menu.
CVE-2018-16773 1Easycms 1Easycms Nov 21, 2024 Sep 10, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field.
CVE-2018-16772 1Hoosk 1Hoosk Nov 21, 2024 Sep 10, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new.
CVE-2018-16759 1Easycms 1Easycms Nov 21, 2024 Sep 9, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The removeXSS function in App/Common/common.php (called from App/Modules/Index/Action/SearchAction.class.php) in EasyCMS v1.4 allows XSS via an onhashchange event.
CVE-2018-16736 1Rcfilters Project 1Rcfilters Nov 21, 2024 Sep 9, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages parameters (in the Filters section of the settings).
CVE-2018-16730 1Chshcms 1Cscms Nov 21, 2024 Sep 8, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 \upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name.
CVE-2018-16725 1Baijiacms Project 1Baijiacms Nov 21, 2024 Sep 8, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue is discovered in baijiacms V4. XSS exists via the assets/weengine/components/zclip/ZeroClipboard.swf id parameter, aka "Non-standard use of the flash component."
CVE-2018-9283 1Cremecrm 1Cremecrm Jun 17, 2026 Sep 7, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An XSS issue was discovered in CremeCRM 1.6.12. It is affected by 10 stored Cross-Site Scripting (XSS) vulnerabilities in the firstname, lastname, billing_address-address, billing_address-zipcode, billing_address-city, b...Show more An XSS issue was discovered in CremeCRM 1.6.12. It is affected by 10 stored Cross-Site Scripting (XSS) vulnerabilities in the firstname, lastname, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department, shipping_address-address, shipping_address-zipcode, shipping_address-city, and shipping_address-department parameters in the contact creation and modification page. The payload is stored within the application database and allows the execution of JavaScript code each time a client visit an infected page.Show less
CVE-2018-16363 1Filemanagerpro 1File Manager Nov 21, 2024 Sep 7, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of...Show more The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php.Show less
CVE-2018-14397 1Cremecrm 1Cremecrm Nov 21, 2024 Sep 7, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in Creme CRM 1.6.12. The organization creation page is affected by 9 stored cross-site scripting vulnerabilities involving the name, billing_address-address, billing_address-zipcode, billing_addre...Show more An issue was discovered in Creme CRM 1.6.12. The organization creation page is affected by 9 stored cross-site scripting vulnerabilities involving the name, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department, shipping_address-address, shipping_address-zipcode, shipping_address-city, and shipping_address-department parameters.Show less
CVE-2018-14396 1Cremecrm 1Cremecrm Nov 21, 2024 Sep 7, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in Creme CRM 1.6.12. The salesman creation page is affected by 10 stored cross-site scripting vulnerabilities involving the firstname, lastname, billing_address-address, billing_address-zipcode, b...Show more An issue was discovered in Creme CRM 1.6.12. The salesman creation page is affected by 10 stored cross-site scripting vulnerabilities involving the firstname, lastname, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department, shipping_address-address, shipping_address-zipcode, shipping_address-city, and shipping_address-department parameters.Show less
CVE-2017-1114 1Ibm 1Campaign Nov 21, 2024 Sep 7, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cred...Show more IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 121152.Show less
CVE-2018-0657 2Ec Cube Gmo Pg 2Ec Cube Payment Module Gmo Pg Payment Module Nov 21, 2024 Sep 7, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) versi...Show more Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, and GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier) allow an attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors.Show less
CVE-2018-0655 1Weseek 1Growi Nov 21, 2024 Sep 7, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page.
CVE-2018-0654 1Weseek 1Growi Nov 21, 2024 Sep 7, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the modal for creating Wiki page.
CVE-2018-0653 1Weseek 1Growi Nov 21, 2024 Sep 7, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via Wiki page view.
CVE-2018-0652 1Weseek 1Growi Nov 21, 2024 Sep 7, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the UserGroup Management section of admin page.
CVE-2018-0642 1Foliovision 1Fv Flowplayer Video Player Nov 21, 2024 Sep 7, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-16655 1Gxlcms 1Gxlcms Nov 21, 2024 Sep 7, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php.

Previous 1...196919701971...2455 Next