← Back
CWE-79

49,374 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JSON object

Loading...

CVEs (49,374)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2026-27655
1Zohocorp
1Manageengine Exchange Reporter Plus
Jul 20, 2026
Apr 3, 2026
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report.
CVE-2026-4108
1Zohocorp
1Manageengine Exchange Reporter Plus
Jul 24, 2026
Apr 3, 2026
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Non-Owner Mailbox Permission report.
CVE-2026-4107
1Zohocorp
1Manageengine Exchange Reporter Plus
Jul 24, 2026
Apr 3, 2026
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Message Count and Size report.
CVE-2026-3880
1Zohocorp
1Manageengine Exchange Reporter Plus
Jul 24, 2026
Apr 3, 2026
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report.
CVE-2026-3879
1Zohocorp
1Manageengine Exchange Reporter Plus
Jul 24, 2026
Apr 3, 2026
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Equipment Mailbox Details report.
CVE-2026-28703
1Zohocorp
1Manageengine Exchange Reporter Plus
Jul 24, 2026
Apr 3, 2026
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.
CVE-2026-28756
1Zohocorp
1Manageengine Exchange Reporter Plus
Jul 24, 2026
Apr 3, 2026
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report.
CVE-2026-28754
1Zohocorp
1Manageengine Exchange Reporter Plus
Jul 24, 2026
Apr 3, 2026
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution Lists report.
CVE-2026-35539
1Roundcube
1Webmail
Jul 24, 2026
Apr 3, 2026
N/A· v4
6.1 MEDIUM· v3
N/A· v2
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.
CVE-2026-35508
1Shynet
1Shynet
Jul 24, 2026
Apr 3, 2026
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Shynet before 0.14.0 allows XSS in urldisplay and iconify template filters,
CVE-2026-35466
1Cmu
1Cveclient
Jul 24, 2026
Apr 2, 2026
N/A· v4
6.1 MEDIUM· v3
N/A· v2
XSS vulnerability in cveInterface.js allows for inject HTML to be passed to display, as cveInterface trusts input from CVE API services
CVE-2026-30252
1Interzen
4Zencrm
ZenhrZenproject+1 more
Jul 24, 2026
Apr 2, 2026
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Multiple reflected cross-site scripting (XSS) vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's brow...Show more
Multiple reflected cross-site scripting (XSS) vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL injected into the codice_azienda and red_url parameters.Show less
CVE-2026-30251
1Interzen
1Zenshare Suite
Jul 24, 2026
Apr 2, 2026
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A reflected cross-site scripting (XSS) vulnerability in the login_newpwd.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browse...Show more
A reflected cross-site scripting (XSS) vulnerability in the login_newpwd.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL injected into the codice_azienda parameter.Show less
CVE-2026-34932
1Hoppscotch
1Hoppscotch
Jul 24, 2026
Apr 2, 2026
8.5 HIGH· v4
9.3 CRITICAL· v3
N/A· v2
hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability that can lead to CSRF. This issue has been patched in version 2026.3.0.
CVE-2026-34848
1Hoppscotch
1Hoppscotch
Jul 24, 2026
Apr 2, 2026
N/A· v4
5.4 MEDIUM· v3
N/A· v2
hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability in the team member overflow tooltip via display name. This issue has been patched in version 2026.3.0...Show more
hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability in the team member overflow tooltip via display name. This issue has been patched in version 2026.3.0.Show less
CVE-2026-5429
-
-
Jul 24, 2026
Apr 2, 2026
7.1 HIGH· v4
7.8 HIGH· v3
N/A· v2
Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a remote unauthenticated threat actor to execute arbitrary code via a potentially damaging crafted color th...Show more
Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a remote unauthenticated threat actor to execute arbitrary code via a potentially damaging crafted color theme name when a local user opens the workspace. This issue requires the user to trust the workspace when prompted. To remediate this issue, users should upgrade to version 0.8.140.Show less
CVE-2026-5370
-
-
Jul 24, 2026
Apr 2, 2026
2.0 LOW· v4
3.5 LOW· v3
4.0 MEDIUM· v2
A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts of the component Activities Module/Notes Module...Show more
A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts of the component Activities Module/Notes Module. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 73ed28d466bf14787fdb86a120c656a4af270153. To fix this issue, it is recommended to deploy a patch.Show less
CVE-2026-34725
-
-
Jul 24, 2026
Apr 2, 2026
N/A· v4
8.2 HIGH· v3
N/A· v2
DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitizatio...Show more
DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in the Electron desktop app this can escalate to local code execution because Electron is configured with nodeIntegration: true and contextIsolation: false. This issue has been patched in version 7.1.5.Show less
CVE-2026-34606
1Frappe
1Learning
Jul 24, 2026
Apr 2, 2026
6.9 MEDIUM· v4
6.1 MEDIUM· v3
N/A· v2
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in...Show more
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in version 2.48.0.Show less
CVE-2026-34598
1Yeswiki
1Yeswiki
Oct 6, 2026
Apr 2, 2026
7.1 HIGH· v4
6.1 MEDIUM· v3
N/A· v2
YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title...Show more
YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in the backend database. When any user visits that injected page, the JavaScript payload gets executed. This issue has been patched in version 4.6.0.Show less