← Back
CWE-83

24 CVEs • Abstraction: Variant

Improper Neutralization of Script in Attributes in a Web Page

The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.

JSON object

Loading...

CVEs (24)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-30958
1Zabbix
1Frontend
Jun 17, 2026
Aug 3, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.225.0....Show more
A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's CSP were to be bypassed. This defect was resolved with the release of Foundry Frontend 6.225.0. Show less
CVE-2023-32070
1Xwiki
2Rendering
Xwiki
Jun 17, 2026
May 10, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs,...Show more
XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version.Show less
CVE-2022-39262
1Glpi Project
1Glpi
Jun 17, 2026
Nov 3, 2022
N/A· v4
4.8 MEDIUM· v3
N/A· v2
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is ca...Show more
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is can contains malicious code that can be used to steal credentials. This issue has been patched, please upgrade to version 10.0.4.Show less
CVE-2020-14525
1Philips
1Clinical Collaboration Platform
Jun 17, 2026
Sep 18, 2020
N/A· v4
3.5 LOW· v3
2.7 LOW· v2
Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a webpage that is served to other users.