← Back
CWE-79

49,082 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (49,082)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-0672
1Sixapart
1Movable Type
Nov 21, 2024
Sep 4, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting vulnerability in Movable Type versions prior to Ver. 6.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-16450
1Craftedweb Project
1Craftedweb
Nov 21, 2024
Sep 4, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
CraftedWeb through 2013-09-24 has reflected XSS via the p parameter.
CVE-2018-16407
1Mayan Edms
1Mayan Edms
Nov 21, 2024
Sep 3, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS because tag label values are mishandled.
CVE-2018-16406
1Mayan Edms
1Mayan Edms
Nov 21, 2024
Sep 3, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Mayan EDMS before 3.0.2. The Cabinets app has XSS via a crafted cabinet label.
CVE-2018-16405
1Mayan Edms
1Mayan Edms
Nov 21, 2024
Sep 3, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets window.location directly, leading to XSS.
CVE-2018-16379
1Digimute
1Ogma Cms
Nov 21, 2024
Sep 3, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Ogma CMS 0.4 Beta has XSS via the "Footer Text footer" field on the "Theme/Theme Options" screen.
CVE-2018-16374
1Frog Cms Project
1Frog Cms
Nov 21, 2024
Sep 3, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Frog CMS 0.9.5 has stored XSS via /admin/?/plugin/comment/settings.
CVE-2018-16372
1Ideacms
1Ideacms
Nov 21, 2024
Sep 3, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The issue was discovered in IdeaCMS through 2016-04-30. There is reflected XSS via the index.php?c=content&a=search kw parameter. NOTE: this product is discontinued.
CVE-2018-16371
1Pescms
1Pescms Team
Nov 21, 2024
Sep 3, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
PESCMS Team 2.2.1 has multiple reflected XSS via the keyword parameter: g=Team&m=User&a=index&keyword=, g=Team&m=User_group&a=index&keyword=, g=Team&m=Department&a=index&keyword=, and g=Team&m=Bulletin&a=index&keyword=.
CVE-2018-16362
1Mantisbt
1Source Integration
Nov 21, 2024
Sep 2, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in the Source Integration plugin before 1.5.9 and 2.x before 2.1.5 for MantisBT. A cross-site scripting (XSS) vulnerability in the Manage Repository and Changesets List pages allows execution of a...Show more
An issue was discovered in the Source Integration plugin before 1.5.9 and 2.x before 2.1.5 for MantisBT. A cross-site scripting (XSS) vulnerability in the Manage Repository and Changesets List pages allows execution of arbitrary code (if CSP settings permit it) via repo_manage_page.php or list.php.Show less
CVE-2018-16358
1Dotclear
1Dotclear
Nov 21, 2024
Sep 2, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file ex...Show more
A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file extension .ahtml.Show less
CVE-2018-16350
1Wuzhi Cms Project
1Wuzhi Cms
Nov 21, 2024
Sep 2, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic form[statcode] parameter.
CVE-2018-16349
1Wuzhi Cms Project
1Wuzhi Cms
Nov 21, 2024
Sep 2, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
WUZHI CMS 4.1.0 has XSS via the index.php?m=link&f=index&v=add form[remark] parameter.
CVE-2018-16348
1Seacms
1Seacms
Nov 21, 2024
Sep 2, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
SeaCMS V6.61 has XSS via the admin_video.php v_content parameter, related to the site name.
CVE-2018-16347
1Gleezcms
1Gleez Cms
Nov 21, 2024
Sep 2, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Gleez CMS v1.2.0. There is XSS via media/imagecache/resize.
CVE-2018-16346
1Chemcms Project
1Chemcms
Nov 21, 2024
Sep 2, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
ChemCMS 1.0.6 has XSS via the "setting -> website information" field.
CVE-2018-16342
1Showdoc
1Showdoc
Nov 21, 2024
Sep 2, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
ShowDoc v1.8.0 has XSS via a new page.
CVE-2018-16330
1Ipandao
1Editor.md
Nov 21, 2024
Sep 2, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.
CVE-2018-16327
1Intelliants
1Subrion
Nov 21, 2024
Sep 1, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.
CVE-2018-16325
1Get Simple
1Getsimple Cms
Nov 21, 2024
Sep 1, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
There is XSS in GetSimple CMS 3.4.0.9 via the admin/edit.php title field.