← Back
CWE-79

49,093 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (49,093)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-14837
1Wolfcms
1Wolf Cms
Nov 21, 2024
Aug 10, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Wolf CMS 0.8.3.1 has XSS in the Snippets tab, as demonstrated by a ?/admin/snippet/edit/1 URI.
CVE-2018-14503
1Coremail
1Coremail Xt
Nov 21, 2024
Aug 10, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in intervalCheck.jsp in Coremail XT 3.0 allows remote attackers to inject arbitrary web script or HTML via the sid parameter.
CVE-2018-15189
1Advanced Real Estate Script Project
1Advanced Real Estate Script
Nov 21, 2024
Aug 10, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
PHP Scripts Mall advanced-real-estate-script has XSS via the Name field of a profile.
CVE-2018-15184
1Naukri Clone Script Project
1Naukri Clone Script
Nov 21, 2024
Aug 9, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 has Stored XSS via the USERNAME field, a related issue to CVE-2018-6795.
CVE-2018-15183
1Myperfectresume / Jobhero / Resume Clone Script Project
1Myperfectresume / Jobhero / Resume Clone Script
Nov 21, 2024
Aug 9, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
PHP Scripts Mall Myperfectresume / JobHero / Resume Clone Script 2.0.6 has Stored XSS via the Full Name and Title fields.
CVE-2018-15182
1Car Rental Script Project
1Car Rental Script
Nov 21, 2024
Aug 9, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the FirstName and LastName fields.
CVE-2018-15181
1Jio
14g Hotspot M2s Firmware
Nov 21, 2024
Aug 9, 2018
N/A· v4
6.5 MEDIUM· v3
6.8 MEDIUM· v2
JioFi 4G Hotspot M2S devices allow attackers to cause a denial of service (secure configuration outage) via an XSS payload in the SSID name and Security Key fields.
CVE-2018-15199
1Auracms
1Auracms
Nov 21, 2024
Aug 8, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
AuraCMS 2.3 allows XSS via a Bukutamu -> AddGuestbook action.
CVE-2018-15169
1Zohocorp
1Manageengine Applications Manager
Nov 21, 2024
Aug 8, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrary web script or HTML via the /deleteMO.do method parameter.
CVE-2018-15130
1Thinksaas
1Thinksaas
Nov 21, 2024
Aug 7, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter.
CVE-2018-1690
1Ibm
1Rhapsody Model Manager
Nov 21, 2024
Aug 7, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
IBM Rhapsody Model Manager 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cre...Show more
IBM Rhapsody Model Manager 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 145510.Show less
CVE-2018-15129
1Thinksaas
1Thinksaas
Nov 21, 2024
Aug 7, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter.
CVE-2018-14869
1Php Template Store Script Project
1Php Template Store Script
Nov 21, 2024
Aug 6, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
PHP Template Store Script 3.0.6 allows XSS via the Address line 1, Address Line 2, Bank name, or A/C Holder name field in a profile.
CVE-2018-7090
1Hp
1Xp 9000 Command View
Jun 17, 2026
Aug 6, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
HPE XP P9000 Command View Advanced Edition Software (CVAE) has local and remote cross site scripting vulnerability in versions 7.0.0-00 to earlier than 8.60-00 of DevMgr, TSMgr and RepMgr.
CVE-2018-7075
1Hp
1Intelligent Management Center
Jun 17, 2026
Aug 6, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A remote cross-site scripting (XSS) vulnerability was identified in HPE Intelligent Management Center (iMC) PLAT version v7.3 (E0506). The vulnerability is fixed in Intelligent Management Center PLAT 7.3 E0605P04 or subs...Show more
A remote cross-site scripting (XSS) vulnerability was identified in HPE Intelligent Management Center (iMC) PLAT version v7.3 (E0506). The vulnerability is fixed in Intelligent Management Center PLAT 7.3 E0605P04 or subsequent version.Show less
CVE-2017-9002
1Hp
1Aruba Clearpass Policy Manager
Nov 21, 2024
Aug 6, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities. By exploiting this vulnerability, an attacker who can trick a logged-in ClearPass administrative user into clicking a...Show more
All versions of Aruba ClearPass prior to 6.6.8 contain reflected cross-site scripting vulnerabilities. By exploiting this vulnerability, an attacker who can trick a logged-in ClearPass administrative user into clicking a link could obtain sensitive information, such as session cookies or passwords. The vulnerability requires that an administrative users click on the malicious link while currently logged into ClearPass in the same browser.Show less
CVE-2017-8991
1Hp
1Centralview Fraud Risk Management
Nov 21, 2024
Aug 6, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
HPE has identified a cross site scripting (XSS) vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF16 for HPE CV 6.1 or subsequent version.
CVE-2016-8527
1Hp
1Airwave
Nov 21, 2024
Aug 6, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS). The vulnerability is present in the VisualRF component of AirWave. By exploiting this vulnerability, a...Show more
Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS). The vulnerability is present in the VisualRF component of AirWave. By exploiting this vulnerability, an attacker who can trick a logged-in AirWave administrative user into clicking a link could obtain sensitive information, such as session cookies or passwords. The vulnerability requires that an administrative users click on the malicious link while currently logged into AirWave in the same browser.Show less
CVE-2016-4406
1Hp
2Integrated Lights Out 3 Firmware
Integrated Lights Out 4 Firmware
Nov 21, 2024
Aug 6, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A remote cross site scripting vulnerability was identified in HPE iLO 3 all version prior to v1.88 and HPE iLO 4 all versions prior to v2.44.
CVE-2016-4400
1Hp
1Network Node Manager I
Nov 21, 2024
Aug 6, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A security vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10. The vulnerability could result in cross-site scripting (XSS).