CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- kortix-ai sunakortix-ai suna Auth Endpoint page.tsx router.push cross site scripting5.3 Medium
- appium appium-mcpMCP Appium: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)8.2 High
@sveltia/cmsnpmSveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe1.1 Low- symfony uxSymfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses6.1 Medium
- starcitizenwiki mediawiki-extensions-embedvideoEmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled7.5 High
- outerbase studioOuterbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure4.4 Medium
- allure-framework allure2, io.qameta.allure allure-generator +1 moreAllure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering6.1 Medium
- tinacms @tinacms/app, tinacms +1 moreTinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover7.6 High
- craftcms cmsCraft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs6.9 Medium
- starcitizenwiki mediawiki-extensions-embedvideoEmbedVideo Extension : Stored XSS via unsanitized class passed to template8.6 High
- starcitizenwiki mediawiki-extensions-embedvideoEmbedVideo Extension: Stored XSS via unsanitized service name in exception text7.5 High
- microsoft edge chromium, edge (chromium-based) +1 moreMicrosoft Entra ID Spoofing Vulnerability8.8 High
- jupyter jupyterlab-gitJupyterLab Git: Stored XSS leading to RCE9.3 Critical
- symfony uxSymfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data5.1 Medium
- symfony uxSymfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag2.3 Low
- gohugo hugoHugo default code block renderer XSS via unescaped code-fence language5.1 Medium
- microchip gridtime 3000, gridtime 3000 firmware +1 moreCross-Site Scripting (XSS) Vulnerability in Password Reset Redirect in GridTime™ 3000 GNSS Time Server5.3 Medium
- microchip gridtime 3000, gridtime 3000 firmware +1 moreGridTime™ 3000 GNSS Time Server CSRF to XSS5.1 Medium
- hcl software verse for androidHCL Verse for Android is susceptible to an injection vulnerability6.3 Medium
- octopus deploy serverIn affected versions of Octopus Server with certain access levels it was possible to embed a...5.6 Medium
- creativethemeshq blocksy companionBlocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter4.4 Medium
- wpdevteam betterdocs – ai documentation, knowledge base, docs, wikis, faq with chatbotBetterDocs <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'blockId' Block Attribute6.4 Medium
- creavi appointment booking calendarAppointment Booking Calendar <= 1.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label6.4 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser9.3 Critical
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception text4.8 Medium
- hashgraph guardianHashgraph Guardian Stored XSS via branding companyName field4.8 Medium
- coturnCoturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN username5.4 Medium
- getgrav grav-plugin-apiStored XSS via missing XSS safety check in Admin2 Pages API partial validation5.1 Medium
- getkirby kirbyKirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`8.5 High
- jupyter server, jupyter-server jupyter server, red hat migration toolkit for applications 8.2 +2 more +4 moreJupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP9.3 Critical
- getgrav gravGrav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style()4.8 Medium
- mervinpraison praisonaiPraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools8.8 High
- tinacms @tinacms/mdx, tinacms +1 moreTinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes4.8 Medium
- ubb systems ubb.threadsReflected XSS in UBB.threads5.1 Medium
- ubb systems ubb.threadsStored XSS in UBB.threads5.1 Medium
- frappe lmsReflected XSS in LMS2.1 Low
- bricksable for bricks builderWordPress Bricksable for Bricks Builder plugin <= 1.6.83 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- oceanwp ocean product sharingWordPress Ocean Product Sharing plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- contrid slideshow gallery liteSlideshow Gallery LITE <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alwaysauto' Shortcode Attribute6.4 Medium
- dijitul fancy testimonialsFancy Testimonials <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting6.4 Medium
- blubrry powerpress podcasting plugin by blubrryPowerPress Podcasting plugin by Blubrry <= 11.16.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'embed' Episode Meta Field6.4 Medium
- phppoet sysbasics customize my account for woocommerce – dashboard, endpoints, avatar & menu managerSysBasics Customize My Account for WooCommerce <= 4.3.6 - Reflected Cross-Site Scripting via 'tab' Parameter6.1 Medium
- phppoet sysbasics customize my account for woocommerce – dashboard, endpoints, avatar & menu managerSysBasics Customize My Account for WooCommerce <= 4.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- cotontiCotonti stored XSS via PFS folder title7.0 High
- bplugins services section block – showcase service details in grid or columnsServices Section Block <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Block Attribute6.4 Medium
- themeisle orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & moreOrbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter4.4 Medium
- baptistearno typebot.ioTypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileName9.3 Critical
- marimo-team marimomarimo < 0.23.9 XSS via file Query Parameter in assets.py5.1 Medium
- shaarliShaarli: DOM-based Cross-Site Scripting (XSS) in Thumbnail Synchronizer5.8 Medium
- shaarliShaarli has Stored Cross-Site Scripting (XSS) via Tags Search4.8 Medium
- Show moreLoading…