CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- frappe frameworkFrappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs rendering4.6 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS in Desktop Icon label rendering4.8 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb rendering5.1 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS in frappe.get_avatar image rendering4.6 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS in Auto Repeat dashboard schedule rendering4.6 Medium
- frappe frameworkFrappe Framework 17.0.0-dev - Stored XSS in Audit Trail template rendering4.6 Medium
- microfocus access managerReflected Cross-Site Scripting vulnerability in OpenText Access Manager8.2 High
- thinkst canarytokensStored Cross-Site Scripting in Canarytokens.org1.1 Low
- pixelwelt image sizes on demandImage Sizes on Demand <= 1.3 - Reflected Cross-Site Scripting via PHP_SELF Server Variable6.1 Medium
- joomunited wp latest postsWP Latest Posts <= 5.0.11 - Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attribute6.4 Medium
- paradigmatools avalon23 products filter for woocommerceAvalon23 Products Filter for WooCommerce <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- mirsoftware mir blocks and shortcodesMIR blocks and shortcodes <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- joomunited wp meta seoWP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging7.2 High
- owencutajar entredroppersEntreDroppers <= 1.1.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter6.1 Medium
- nicashmu cincopa video and media plug-inCincopa video and media plug-in <= 1.163 - Unauthenticated Stored Cross-Site Scripting via cincopa Shortcode in Post Comments7.2 High
- cgarvey email javascript cloakEmail JavaScript Cloak <= 1.03 - Unauthenticated Stored Cross-Site Scripting7.2 High
- repute info systems arformsARForms <= 7.1.3 - Unauthenticated Stored Cross-Site Scripting via 'value' Parameter7.2 High
- xpro addons — 140+ widgets for elementorXpro Addons <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets6.4 Medium
- flatpressFlatPress - Stored Cross-Site Scripting via Unescaped Comment and Contact Form Fields8.4 High
- fortra file integrity monitoring (fim), file integrity monitoring +1 moreStored XSS in Fortra File Integrity Monitoring (FIM)5.5 Medium
- avideoAVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants Panel5.1 Medium
- immich-app immichimmich: One-click account takeover via XSS in login page continue redirect9.6 Critical
- gogsGogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS5.4 Medium
- gogsGogs: DOM-based XSS via Milestone Name on New Issue Page4.8 Medium
- revive adserverA stored XSS can be exploited by leveraging the usernames as an attack vector. When an admin user...0.0 None
- revive adserverLow‑privileged users could use their Full Name as a vector for a stored XSS attack. The name is...0.0 None
- revive adserverA missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and...6.1 Medium
- drimo cmsReflected XSS in DRIMO CMS5.1 Medium
- metagauss profilegrid – user profiles, groups and communitiesProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content6.4 Medium
- akin software computer import export industry and trade ltd. e-commerceReflected XSS in Akinsoft's e-Commerce6.1 Medium
- eclipse open vsxOpen VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and...4.1 Medium
- gogsGogs: Stored XSS in `.ipynb` Preview8.9 High
devbridge-autocompletenpmdevbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs5.4 Medium- filamentphp filamentFilament: Unvalidated ImageColumn and ImageEntry values can be used for XSS6.4 Medium
- openidentityplatform openamOpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`7.0 High
- openidentityplatform openamOpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)8.3 High
- akauntingAkaunting 3.1.21 - Authenticated stored XSS in report description rendering4.8 Medium
- akauntingAkaunting 3.1.21 - Authenticated stored XSS in document timeline4.8 Medium
- angular, angular language service, angular.ng-template +2 moreAngular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension8.7 High
- akauntingAkaunting 3.1.21 - Stored XSS in delete confirmation modal4.8 Medium
- angular, angular language service +1 moreAngular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension8.7 High
- ibm datacap, datacap navigator +1 moreMultiple Vulnerabilities in IBM Datacap6.1 Medium
- ibm tririga application platformIBM TRIRIGA Cross-Site Scripting Vulnerability5.4 Medium
- ibm engineering workflow managementIBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities HTML / XSS Injection observed5.4 Medium
- grafana oss, grafana +1 moreStored XSS in the Geomap panel tile-layer attribution7.3 High
- digiwin easyflow .netDigiwin｜EasyFlow .NET - Stored Cross-Site Scripting5.1 Medium
- pilz pasvisu, pmi v8xx +1 morePilz: XSS vulnerability in Pilz PASvisu and PMI v8xx7.8 High
- pilz pasvisu, pmi v8xx +1 moreXSS vulnerability in Pilz PASvisu and PMI v8xx8.1 High
- unknown transbank webpayTransbank Webpay < 1.14.0 - Unauthenticated Stored XSS7.1 High
- unknown ultimate-woocommerce-auction-proUltimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_manage_auctions7.1 High
- Show moreLoading…