← Back
CWE-79

49,082 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (49,082)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-16324
1Icewarp
1Mail Server
Nov 21, 2024
Sep 1, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field.
CVE-2018-16316
1Portainer
1Portainer
Nov 21, 2024
Sep 1, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field.
CVE-2018-16313
1Bludit
1Bludit
Nov 21, 2024
Sep 1, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Bludit 2.3.4 allows XSS via a user name.
CVE-2018-16298
11234n
1Minicms
Nov 21, 2024
Aug 31, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request.
CVE-2018-16236
1Cpanel
1Cpanel
Nov 21, 2024
Aug 30, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering.
CVE-2018-16234
1Morningstarsecurity
1Whatweb
Nov 21, 2024
Aug 30, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
MorningStar WhatWeb 0.4.9 has XSS via JSON report files.
CVE-2018-16233
11234n
1Minicms
Nov 21, 2024
Aug 30, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.
CVE-2018-14899
1Epson
1Wf 2750 Firmware
Nov 21, 2024
Aug 30, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
On the EPSON WF-2750 printer with firmware JP02I2, the Web interface AirPrint Setup page is vulnerable to HTML Injection that can redirect users to malicious sites.
CVE-2018-13825
2Broadcom
Ca
2Project Portfolio Management
Project Portfolio Management
Nov 21, 2024
Aug 30, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute reflected cross-site scripting atta...Show more
Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute reflected cross-site scripting attacks.Show less
CVE-2018-16142
1Phpok
1Phpok
Nov 21, 2024
Aug 30, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
PHPOK 4.8.278 has a Reflected XSS vulnerability in framework/www/login_control.php via the _back parameter to the ok_f function.
CVE-2018-16134
1Cybrotech
1Cybrohttpserver
Nov 21, 2024
Aug 29, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI.
CVE-2018-7795
1Schneider Electric
1Powerlogic Pm5560 Firmware
Jun 17, 2026
Aug 29, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. The vulnerability makes the product susceptible to cross site scripting attack on its web bro...Show more
A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. The vulnerability makes the product susceptible to cross site scripting attack on its web browser. User inputs can be manipulated to cause execution of java script code.Show less
CVE-2018-15562
1Isweb
1Isweb
Nov 21, 2024
Aug 29, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php.
CVE-2018-12806
1Adobe
1Experience Manager
Nov 21, 2024
Aug 29, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2018-15880
1Joomla
1Joomla
Nov 21, 2024
Aug 29, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in Joomla! before 3.8.12. Inadequate output filtering on the user profile page could lead to a stored XSS attack.
CVE-2018-15896
1Website Seller Script Project
1Website Seller Script
Nov 21, 2024
Aug 28, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name.
CVE-2017-15429
3Debian
GoogleRedhat
5Chrome
Debian LinuxEnterprise Linux Desktop+2 more
Nov 21, 2024
Aug 28, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Inappropriate implementation in V8 WebAssembly JS bindings in Google Chrome prior to 63.0.3239.108 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
CVE-2018-6643
1Infoblox
1Netmri
Jun 17, 2026
Aug 28, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Infoblox NetMRI 7.1.1 has Reflected Cross-Site Scripting via the /api/docs/index.php query parameter.
CVE-2018-15884
1Ricoh
1Mp C4504ex Firmware
Nov 21, 2024
Aug 28, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
RICOH MP C4504ex devices allow HTML Injection via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.
CVE-2018-15740
1Zohocorp
1Manageengine Admanager Plus
Nov 21, 2024
Aug 28, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen.