← Back
CWE-80

584 CVEs • Abstraction: Variant • Likelihood of Exploit: High

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

JSON object

Loading...

CVEs (584)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2017-16043
1Shout Project
1Shout
Nov 21, 2024
Jun 4, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3.
CVE-2017-16015
1Forms Project
1Forms
Nov 21, 2024
Jun 4, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize html on behalf of forms, use of forms may be vulnerable to c...Show more
Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize html on behalf of forms, use of forms may be vulnerable to cross site scriptingShow less
CVE-2014-2353
1Cogentdatahub
1Cogent Datahub
May 6, 2026
May 30, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2006-0149
1Simpbook
1Simpbook
Apr 16, 2026
Jan 9, 2006
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in SimpBook 1.0, with html_enable on (the default), allows remote attackers to inject arbitrary web script or HTML via the message field.