Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (49,082)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-16654 1Zurmo 1Zurmo Crm Nov 21, 2024 Sep 7, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1.
CVE-2018-16653 1Rejucms Project 1Rejucms Nov 21, 2024 Sep 7, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 rejucms 2.1 has XSS via the ucenter/cms_user_add.php u_name parameter.
CVE-2018-16285 1Userproplugin 1Userpro Nov 21, 2024 Sep 6, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php.
CVE-2018-12234 1Myadrenalin 1Adrenalin Mar 2, 2026 Sep 6, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4.0 HRMS Software. The user supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the flexiporta...Show more A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4.0 HRMS Software. The user supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the flexiportal/GeneralInfo.aspx strAction parameter.Show less
CVE-2018-5005 1Adobe 1Experience Manager Nov 21, 2024 Sep 6, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a Cross-site Scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2018-16622 1Html Js 1Doracms Nov 21, 2024 Sep 6, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) discription or (2) comments field, related to users/u...Show more Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) discription or (2) comments field, related to users/userAddContent.Show less
CVE-2018-1000670 1Koha 1Koha Nov 21, 2024 Sep 6, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Scripting (XSS) vulnerability in Multiple fields on multiple pages including /cgi-bin/koha/acqui/supplier.pl?o...Show more KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Scripting (XSS) vulnerability in Multiple fields on multiple pages including /cgi-bin/koha/acqui/supplier.pl?op=enter , /cgi-bin/koha/circ/circulation.pl?borrowernumber=[number] , /cgi-bin/koha/serials/subscription-add.pl that can result in Privilege escalation by taking control of higher privileged users browser sessions. This attack appear to be exploitable via Victims must be socially engineered to visit a vulnerable webpage containing malicious payload. This vulnerability appears to have been fixed in 17.11.Show less
CVE-2018-1000665 1Dojotoolkit 1Dojo Nov 21, 2024 Sep 6, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in unit.html and testsDOH/_base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/_base/i18nExhaus...Show more Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in unit.html and testsDOH/_base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/_base/i18nExhaustive.js in the DOH that can result in Victim attacked through their browser - deliver malware, steal HTTP cookies, bypass CORS trust. This attack appear to be exploitable via Victims are typically lured to a web site under the attacker's control; the XSS vulnerability on the target domain is silently exploited without the victim's knowledge. This vulnerability appears to have been fixed in 1.14.Show less
CVE-2018-16459 1Exceljs Project 1Exceljs Nov 21, 2024 Sep 6, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser.
CVE-2018-16551 1Lavalite 1Lavalite Nov 21, 2024 Sep 5, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.
CVE-2018-16381 1E107 1E107 Nov 21, 2024 Sep 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 e107 2.1.8 has XSS via the e107_admin/users.php?mode=main&action=list user_loginname parameter.
CVE-2018-16361 1Btiteam 1Xbtit Nov 21, 2024 Sep 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows XSS via the id parameter.
CVE-2018-16148 1Opsview 1Opsview Nov 21, 2024 Sep 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The diagnosticsb2ksy parameter of the /rest endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site Scripting.
CVE-2018-16147 1Opsview 1Opsview Nov 21, 2024 Sep 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The data parameter of the /settings/api/router endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site Scripting.
CVE-2018-15917 1Jorani Project 1Jorani Nov 21, 2024 Sep 5, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language.
CVE-2018-15679 1Btiteam 1Xbtit Nov 21, 2024 Sep 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function available at /index.php?page=forums&action=search is vulnerable to reflected cross-site scripting.
CVE-2018-15678 1Btiteam 1Xbtit Nov 21, 2024 Sep 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting.
CVE-2018-15677 1Btiteam 1Xbtit Nov 21, 2024 Sep 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. This is also exploitable via CSRF.
CVE-2018-15676 1Btiteam 1Xbtit Nov 21, 2024 Sep 5, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 An issue was discovered in BTITeam XBTIT. By using String.replace and eval, it is possible to bypass the includes/crk_protection.php anti-XSS mechanism that looks for a number of dangerous fingerprints.
CVE-2018-16516 1Flask Admin Project 1Flask Admin Nov 21, 2024 Sep 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL.

Previous 1...197019711972...2455 Next