← Back
CWE-79

49,132 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (49,132)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-11208
1Zblogcn
1Z Blogphp
Nov 21, 2024
May 16, 2018
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in Z-BlogPHP 2.0.0. There is a persistent XSS that allows remote attackers to inject arbitrary web script or HTML into background web site settings via the "copyright information office" field. NO...Show more
An issue was discovered in Z-BlogPHP 2.0.0. There is a persistent XSS that allows remote attackers to inject arbitrary web script or HTML into background web site settings via the "copyright information office" field. NOTE: the vendor indicates that the product was not intended to block this type of XSS by a user with the admin privilegeShow less
CVE-2018-10810
1Livezilla
1Livezilla
Nov 21, 2024
May 16, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
chat/mobile/index.php in LiveZilla Live Chat 7.0.9.5 and prior is affected by Cross-Site Scripting via the Accept-Language HTTP header.
CVE-2017-2610
1Jenkins
1Jenkins
Nov 21, 2024
May 15, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping users with less-than and greater-than characters in their names (SECURITY-388).
CVE-2018-11105
13cx
1Live Chat
Nov 21, 2024
May 15, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email) input fields to wp-json/wp_live_chat_support/v1/start_chat w...Show more
There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email) input fields to wp-json/wp_live_chat_support/v1/start_chat whenever a malicious attacker would initiate a new chat with an administrator. NOTE: this issue exists because of an incomplete fix for CVE-2018-9864.Show less
CVE-2018-11090
1Mybiz
1Myprocurenet
Nov 21, 2024
May 14, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An XSS issue was discovered in MyBiz MyProcureNet 5.0.0. This vulnerability within "ProxyPage.aspx" allows an attacker to inject malicious client side scripting which will be executed in the browser of users if they visi...Show more
An XSS issue was discovered in MyBiz MyProcureNet 5.0.0. This vulnerability within "ProxyPage.aspx" allows an attacker to inject malicious client side scripting which will be executed in the browser of users if they visit the manipulated site.Show less
CVE-2018-10994
1Signal
1Signal Desktop
Nov 21, 2024
May 14, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL.
CVE-2018-5230
1Atlassian
2Jira
Jira Server
Nov 21, 2024
May 14, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and from version 7.9.0 before version 7.9.2 allows remote attackers to inject a...Show more
The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and from version 7.9.0 before version 7.9.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the error message of custom fields when an invalid value is specified.Show less
CVE-2018-0585
1Ultimatemember
1Ultimate Member
Nov 21, 2024
May 14, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-0583
1Asus
1Rt Ac1200hp Firmware
Nov 21, 2024
May 14, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting vulnerability in ASUS RT-AC1200HP Firmware version prior to 3.0.0.4.380.4180 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-0582
1Asus
1Rt Ac68u Firmware
Nov 21, 2024
May 14, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting vulnerability in ASUS RT-AC68U Firmware version prior to 3.0.0.4.380.1031 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-0581
1Asus
1Rt Ac87u Firmware
Nov 21, 2024
May 14, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting vulnerability in ASUS RT-AC87U Firmware version prior to 3.0.0.4.378.9383 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-0579
1Webdados
1Open Graph For Facebook, Google+ And Twitter Card Tags
Nov 21, 2024
May 14, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified ve...Show more
Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.Show less
CVE-2018-0578
1Pixelyoursite
1Pixelyoursite
Nov 21, 2024
May 14, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-0577
1Flippercode
1Wp Google Map
Nov 21, 2024
May 14, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross-site scripting vulnerability in WP Google Map Plugin prior to version 4.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-0576
1Pixelite
1Events Manager
Nov 21, 2024
May 14, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-16860
1Atlassian
1Application Links
Nov 21, 2024
May 14, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version 5.3.0 before version 5.3.4 and from version 5.4.0 before version 5.4.3 allows remote attackers to inject arbitrary HTML or...Show more
The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version 5.3.0 before version 5.3.4 and from version 5.4.0 before version 5.4.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the redirectUrl parameter link in the redirect warning message.Show less
CVE-2018-11012
1Halo
1Halo
Nov 21, 2024
May 12, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java.
CVE-2018-11011
1Halo
1Halo
Nov 21, 2024
May 12, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java.
CVE-2018-6362
1Ehcp
1Easy Hosting Control Panel
Jun 17, 2026
May 11, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the domainop action parameter, as demonstrated by reading the PHPSESSID cookie.
CVE-2018-6361
1Ehcp
1Easy Hosting Control Panel
Jun 17, 2026
May 11, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the op parameter, as demonstrated by adding a backdoor FTP account.