← Back
CWE-79

49,114 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (49,114)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-1000513
1Limesurvey
1Limesurvey
Nov 21, 2024
Jun 26, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting (XSS) vulnerability in Boxes that can result in JS code execution against LimeSurvey admins. This vulnerability appears to have been fixed in 3.6.x.
CVE-2018-1000512
1Tooltipy Project
1Tooltipy
Nov 21, 2024
Jun 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Tooltipy Tooltipy (tooltips for WP) version 5 contains a Cross Site Scripting (XSS) vulnerability in Glossary shortcode that can result in could allow anybody to do almost anything an admin can. This attack appear to be...Show more
Tooltipy Tooltipy (tooltips for WP) version 5 contains a Cross Site Scripting (XSS) vulnerability in Glossary shortcode that can result in could allow anybody to do almost anything an admin can. This attack appear to be exploitable via Admin must follow a link. This vulnerability appears to have been fixed in 5.1.Show less
CVE-2018-1000508
1Wpulike
1Ulike
Nov 21, 2024
Jun 26, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting (XSS) vulnerability in Settings screen that can result in allows unauthorised users to do almost anything an admin can. This attack appear to be exploitable via...Show more
WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting (XSS) vulnerability in Settings screen that can result in allows unauthorised users to do almost anything an admin can. This attack appear to be exploitable via Admin must visit logs page. This vulnerability appears to have been fixed in 3.2.Show less
CVE-2018-0612
15000 Trillion Yen Converter Project
15000 Trillion Yen Converter
Nov 21, 2024
Jun 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting vulnerability in 5000 trillion yen converter v1.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-0605
1Pixelpost
1Pixelpost
Nov 21, 2024
Jun 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting vulnerability in Pixelpost v1.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-0603
1Geminilabs
1Site Reviews
Nov 21, 2024
Jun 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-0602
1Email Subscribers & Newsletters Project
1Email Subscribers & Newsletters
Nov 21, 2024
Jun 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-0574
1Basercms
1Basercms
Nov 21, 2024
Jun 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-0570
1Basercms
1Basercms
Nov 21, 2024
Jun 26, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified ve...Show more
Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.Show less
CVE-2018-0565
1Cybozu
1Office
Nov 21, 2024
Jun 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.8.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-0559
1Cybozu
1Mailwise
Nov 21, 2024
Jun 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'Address' via unspecified vectors.
CVE-2018-0558
1Cybozu
1Mailwise
Nov 21, 2024
Jun 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Reflected cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML in 'System settings' via unspecified vectors.
CVE-2018-0557
1Cybozu
1Mailwise
Nov 21, 2024
Jun 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Stored cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'E-mail Details Screen' via unspecified vectors.
CVE-2018-0527
1Cybozu
1Office
Nov 21, 2024
Jun 26, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-11588
1Centreon
2Centreon
Centreon Web
Nov 21, 2024
Jun 25, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php...Show more
Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php and www/include/configuration/configObject/command/formArguments.php.Show less
CVE-2018-12705
1Digisol
1Dg Br4000ng Firmware
Nov 21, 2024
Jun 24, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
DIGISOL DG-BR4000NG devices have XSS via the SSID (it is validated only on the client side).
CVE-2018-12696
1Mao10
1Mao10cms
Nov 21, 2024
Jun 23, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
mao10cms 6 allows XSS via the article page.
CVE-2018-12695
1Mao10
1Mao10cms
Nov 21, 2024
Jun 23, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
mao10cms 6 allows XSS via the m=bbs&a=index page.
CVE-2018-12658
1Slims Project
1Slims
Nov 21, 2024
Jun 22, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Reflected Cross-Site Scripting (XSS) exists in the Stock Take module in SLiMS 8 Akasia 8.3.1 via an admin/modules/stock_take/index.php?keywords= URI.
CVE-2018-12657
1Slims Akasia Project
1Slims Akasia
Nov 21, 2024
Jun 22, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Reflected Cross-Site Scripting (XSS) exists in the Master File module in SLiMS 8 Akasia 8.3.1 via an admin/modules/master_file/rda_cmc.php?keywords= URI.