Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVEs (49,111)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-13106 1Clippercms 1Clippercms Nov 21, 2024 Jul 3, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 ClipperCMS 1.3.3 has stored XSS via the "Tools -> Configuration" screen of the manager/ URI.
CVE-2018-7786 1Schneider Electric 1U.motion Builder Jun 17, 2026 Jul 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In Schneider Electric U.motion Builder software versions prior to v1.3.4, a cross site scripting (XSS) vulnerability exists which could allow injection of malicious scripts.
CVE-2018-13065 1Owasp 1Modsecurity Jul 3, 2025 Jul 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. NOTE: a third party has disputed this issue because it may only apply to environments without a Core Rule Set configured
CVE-2018-12255 1Invoiceplane 1Invoiceplane Nov 21, 2024 Jul 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field.
CVE-2018-10076 1Zohocorp 1Manageengine Eventlog Analyzer Nov 21, 2024 Jul 2, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Zoho ManageEngine EventLog Analyzer 11.12. A Cross-Site Scripting vulnerability allows a remote attacker to inject arbitrary web script or HTML via the search functionality (the search box of t...Show more An issue was discovered in Zoho ManageEngine EventLog Analyzer 11.12. A Cross-Site Scripting vulnerability allows a remote attacker to inject arbitrary web script or HTML via the search functionality (the search box of the Dashboard).Show less
CVE-2018-10075 1Zohocorp 1Manageengine Eventlog Analyzer Nov 21, 2024 Jul 2, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Zoho ManageEngine EventLog Analyzer 11.12 allows remote attackers to inject arbitrary web script or HTML via the import logs feature.
CVE-2018-0499 2Canonical Xapian 2Ubuntu Linux Xapian Core Nov 21, 2024 Jul 2, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet().
CVE-2018-13039 1Opendesa 1Opensid Nov 21, 2024 Jul 1, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 OpenSID 18.06-pasca has reflected Cross Site Scripting (XSS) via the cari parameter, aka an index.php/first?cari= URI.
CVE-2018-7475 1Icewarp 1Mail Server Jun 17, 2026 Jun 30, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability for webdav/ticket/ URIs in IceWarp Mail Server 12.0.3 allows remote attackers to inject arbitrary web script or HTML.
CVE-2018-13003 1Opentsdb 1Opentsdb Nov 21, 2024 Jun 29, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'type' to the /suggest URI.
CVE-2018-13002 1Weblication 1Cms Core & Grid Nov 21, 2024 Jun 29, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the `wFilemanager.php` and `index.php` files of the `/grid5/scripts/` modules. The injection point i...Show more An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the `wFilemanager.php` and `index.php` files of the `/grid5/scripts/` modules. The injection point is located in the Project `Title` and the execution point occurs in the `Inhaltsprojekte` output listing section. Remote attackers with privileged user accounts are able to inject their own malicious script code with a persistent attack vector to compromise user session credentials or to manipulate the affected web-application module output context. The request method to inject is POST.Show less
CVE-2018-13001 1Sandoba 1Cp\ Nov 21, 2024 Jun 29, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the `admin.php` file of the `./cpshop/` module. Remote attackers are able to inject their own script codes to the client-side reques...Show more An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the `admin.php` file of the `./cpshop/` module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability is non-persistent and the request method to inject/execute is GET with the path, search, rename, or dir parameter.Show less
CVE-2018-13000 1Anelectron 1Advanced Electron Forum Nov 21, 2024 Jun 29, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An XSS issue was discovered in Advanced Electron Forum (AEF) v1.0.9. A persistent XSS vulnerability is located in the `FTP Link` element of the `Private Message` module. The editor of the private message module allows in...Show more An XSS issue was discovered in Advanced Electron Forum (AEF) v1.0.9. A persistent XSS vulnerability is located in the `FTP Link` element of the `Private Message` module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to inject malicious script code payloads as a private message (aka pmbody). The injection point is the editor ftp link element and the execution point occurs in the message body context on arrival. The request method to inject is POST with restricted user privileges.Show less
CVE-2018-12998 1Zohocorp 5Firewall Analyzer Manageengine Netflow AnalyzerManageengine Network Configuration Manager+2 more Nov 21, 2024 Jun 29, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 12316...Show more A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.Show less
CVE-2018-12996 1Zohocorp 1Manageengine Applications Manager Nov 21, 2024 Jun 29, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to Graphica...Show more A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitrary web script or HTML via the parameter 'method' to GraphicalView.do.Show less
CVE-2018-12992 1Maelostore Project 1Maelostore Nov 21, 2024 Jun 29, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue was discovered CMS MaeloStore V.1.5.0. There is stored XSS in the Telephone field of the admin interface.
CVE-2018-12973 1Opentsdb 1Opentsdb Nov 21, 2024 Jun 29, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI.
CVE-2018-1351 1Fortinet 1Fortimanager Nov 21, 2024 Jun 28, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.6 and below versions allows attacker to execute HTML/javascript code via managed remote devices CLI commands by viewing the remote device CLI...Show more A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.6 and below versions allows attacker to execute HTML/javascript code via managed remote devices CLI commands by viewing the remote device CLI config installation log.Show less
CVE-2018-1507 1Ibm 1Rational Doors Next Generation Nov 21, 2024 Jun 27, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM DOORS Next Generation (DNG/RRC) 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadi...Show more IBM DOORS Next Generation (DNG/RRC) 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 141415.Show less
CVE-2018-12919 1Craftedweb Project 1Craftedweb Nov 21, 2024 Jun 27, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In CraftedWeb through 2013-09-24, aasp_includes/pages/notice.php allows XSS via the e parameter.

Previous 1...198919901991...2456 Next