CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +1 more +3 moreAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +1 more +3 moreAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +1 more +3 moreAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System exam.php cross site scripting5.3 Medium
facturascripts/facturascriptsPackagistFacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`3.5 Low- microsoft visual studio codeVisual Studio Code Security Feature Bypass Vulnerability7.1 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability4.6 Medium
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability7.3 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability7.3 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability4.6 Medium
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability7.3 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability4.6 Medium
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability4.6 Medium
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability4.6 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 moreActive Directory Federation Server Spoofing Vulnerability4.8 Medium
- microsoft power bi report serverMicrosoft PowerBI Report Server Spoofing Vulnerability8.0 High
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Spoofing Vulnerability9.6 Critical
- bulwarkmail webmailRoundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS)....4.7 Medium
- bulwarkmail webmailIn Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting ...7.2 High
- fortinet fortios, fortipam, fortiproxy +1 more +3 moreAn Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...6.1 Medium
- alextselegidis easyappointmentsEasy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS2.6 Low
- rockwell automation factorytalk® datamosaix™ private cloudRockwell Automation FactoryTalk® DataMosaix™ Private Cloud - Stored Cross-Site Scripting8.4 High
- dan-in-ca sip, sustainable irrigation platform +1 moreSustainable Irrigation Platform 5.2.16 Stored XSS via Program Name5.3 Medium
- code-projects online job portalcode-projects Online Job Portal DetailJob.php cross site scripting5.1 Medium
- aguilatechnologies wp customer areaWP Customer Area <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute6.4 Medium
- blazethemes news kit addons for elementorNews Kit Addons For Elementor <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets6.4 Medium
- sap se @ui5/webcomponents-baseAllowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection6.1 Medium
- sap se netweaver application server abap (applications based on business server pages)Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on Business Server Pages)4.7 Medium
- sap se netweaver enterprise portalCross Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal6.1 Medium
- sap se netweaver application server java(configuration wizard)Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configuration Wizard)8.2 High
- osticketosTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored...6.4 Medium
- hedgedocHedgeDoc: Stored HTML injection via email local-part5.1 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System subject.php cross site scripting5.3 Medium
- churchcrm crmChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values7.0 High
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System forsubject.php cross site scripting5.3 Medium
- themefusion avada (fusion) builderAvada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title6.4 Medium
- plank laravel-mediableLaravel-Mediable < 7.0.0 Stored XSS via SVG File Upload5.3 Medium
- phoenixframework phoenix live viewScheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>5.1 Medium
nukeviet/nukevietPackagistNukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module8.7 High- rejetto hfsRejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listing5.1 Medium
- rejetto hfsRejetto HFS < 3.2.1 Stored XSS in Admin Log Viewer5.3 Medium
nukeviet/nukevietPackagistNukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')8.7 Highnukeviet/nukevietPackagistNukeViet: Unauthenticated Reflected XSS in Comment Module8.2 High- mura software cmsRemote code execution in Mura Software’s CMS9.3 Critical
- rd station conversas tallos chatSelf Cross-Site Scripting (Self-XSS) in Tallos Chat by RD Station Conversas0.0 None
- room 34 creative services, llc ics calendarWordPress ICS Calendar plugin <= 12.1.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- funnelkit funnel builder by funnelkitWordPress Funnel Builder by FunnelKit plugin <= 3.15.0.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpmu dev - your all-in-one wordpress platform forminatorWordPress Forminator plugin <= 1.55.0.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- merkulove speakerWordPress Speaker plugin <= 4.1.13 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- plugin envision envision page builderWordPress Envision Page Builder plugin <= 0.22 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…