Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (49,093)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-15847 1Puppycms 1Puppycms Nov 21, 2024 Aug 25, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in puppyCMS 5.1. There is an XSS vulnerability via menu.php in the "Add Page/URL" URL link field.
CVE-2018-15843 1Get Simple 1Getsimple Cms Nov 21, 2024 Aug 25, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field.
CVE-2018-15842 1Wolfcms 1Wolf Cms Nov 21, 2024 Aug 25, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 WolfCMS 0.8.3.1 has XSS via the /?/admin/page/add slug parameter.
CVE-2018-15875 1Dlink 1Dir 615 Firmware Nov 21, 2024 Aug 25, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability on D-Link DIR-615 routers 20.07 allows attackers to inject JavaScript into the router's admin UPnP page via the description field in an AddPortMapping UPnP SOAP request.
CVE-2018-15874 1Dlink 1Dir 615 Firmware Nov 21, 2024 Aug 25, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability on D-Link DIR-615 routers 20.07 allows an attacker to inject JavaScript into the "Status -> Active Client Table" page via the hostname field in a DHCP request.
CVE-2018-14059 1Pimcore 1Pimcore Nov 21, 2024 Aug 24, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Val...Show more Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions.Show less
CVE-2018-15605 1Phpmyadmin 1Phpmyadmin Nov 21, 2024 Aug 24, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import...Show more An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature.Show less
CVE-2016-9605 1Cobbler Project 1Cobbler Nov 21, 2024 Aug 22, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigating to a vulnerable URL...Show more A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigating to a vulnerable URL via cobbler-web on a default installation.Show less
CVE-2018-15533 1Geutebrueck 1Re Porter 16 Firmware Nov 21, 2024 Aug 21, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected cross-site scripting vulnerability exists in Geutebrueck re_porter 16 before 7.8.974.20 by appending a query string to /modifychannel/exec or /images/*.png on TCP port 12005.
CVE-2018-15528 1Javasystemsolutions 1Sso Plugin Nov 21, 2024 Aug 21, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Reflected Cross-Site Scripting exists in the Java System Solutions SSO plugin 4.0.13.1 for BMC MyIT. A remote attacker can abuse this issue to inject client-side scripts into the "select_sso()" function. The payload is t...Show more Reflected Cross-Site Scripting exists in the Java System Solutions SSO plugin 4.0.13.1 for BMC MyIT. A remote attacker can abuse this issue to inject client-side scripts into the "select_sso()" function. The payload is triggered when the victim opens a prepared /ux/jss-sso/arslogin?[XSS] link and then clicks the "Login" button.Show less
CVE-2018-15603 1Victor Cms Project 1Victor Cms Nov 21, 2024 Aug 21, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the Author field of the "Leave a Comment" screen.
CVE-2018-1394 1Ibm 6Rational Doors Next Generation Rational Engineering Lifecycle ManagerRational Quality Manager+3 more Nov 21, 2024 Aug 20, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Multiple IBM Rational products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cred...Show more Multiple IBM Rational products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138425.Show less
CVE-2018-1000225 1Cobblerd 1Cobbler Nov 21, 2024 Aug 20, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbl...Show more Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to be exploitable via "network connectivity". Sending unauthenticated JavaScript payload to the Cobbler XMLRPC API (/cobbler_api).Show less
CVE-2018-1000219 1Open Emr 1Openemr Nov 21, 2024 Aug 20, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'scan' parameter in line #41 of interface/fax/fax_view.php that can result in The vulnerability could allow remote authenticated attacke...Show more OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'scan' parameter in line #41 of interface/fax/fax_view.php that can result in The vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.. This attack appear to be exploitable via The victim must visit on a specially crafted URL..Show less
CVE-2018-1000218 1Open Emr 1Openemr Nov 21, 2024 Aug 20, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'file' parameter in line #43 of interface/fax/fax_view.php that can result in The vulnerability could allow remote authenticated attacke...Show more OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'file' parameter in line #43 of interface/fax/fax_view.php that can result in The vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.. This attack appear to be exploitable via The victim must visit on a specially crafted URL..Show less
CVE-2018-1000642 1Flightairmap 1Flightairmap Nov 21, 2024 Aug 20, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 FlightAirMap version <=v1.0-beta.21 contains a Cross Site Scripting (XSS) vulnerability in GET variable used within registration sub menu page that can result in unauthorised actions and access to data, stealing session...Show more FlightAirMap version <=v1.0-beta.21 contains a Cross Site Scripting (XSS) vulnerability in GET variable used within registration sub menu page that can result in unauthorised actions and access to data, stealing session information. This vulnerability appears to have been fixed in after commit 22b09a3.Show less
CVE-2018-1000640 1Villagedefrance 1Opencart Overclocked Nov 21, 2024 Aug 20, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 OpenCart-Overclocked version <=1.11.1 contains a Cross Site Scripting (XSS) vulnerability in User input entered unsanitised within JS function in the template that can result in Unauthorised actions and access to data, s...Show more OpenCart-Overclocked version <=1.11.1 contains a Cross Site Scripting (XSS) vulnerability in User input entered unsanitised within JS function in the template that can result in Unauthorised actions and access to data, stealing session information, denial of service. This attack appear to be exploitable via Malicious input passed in GET parameter.Show less
CVE-2018-1000638 11234n 1Minicms Nov 21, 2024 Aug 20, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 MiniCMS version 1.1 contains a Cross Site Scripting (XSS) vulnerability in http://example.org/mc-admin/page.php?date={payload} that can result in code injection.
CVE-2018-15574 1Reprisesoftware 1Reprise License Manager Apr 30, 2025 Aug 20, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in the license editor in Reprise License Manager (RLM) through 12.2BL2. It is a cross-site scripting vulnerability in the /goform/edit_lf_get_data lf parameter via GET or POST. NOTE: the vendor ha...Show more An issue was discovered in the license editor in Reprise License Manager (RLM) through 12.2BL2. It is a cross-site scripting vulnerability in the /goform/edit_lf_get_data lf parameter via GET or POST. NOTE: the vendor has stated "We do not consider this a vulnerability."Show less
CVE-2018-15570 1Bijiadao 1Waimai Super Cms Nov 21, 2024 Aug 20, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 In waimai Super Cms 20150505, there is stored XSS via the /admin.php/Foodcat/editsave fcname parameter.

Previous 1...197419751976...2455 Next