CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- tugcantopaloglu openclaw-dashboard, openclaw agent dashboard +1 moreOpenClaw Dashboard Stored XSS via lastMessage Session Field8.8 High
- adonisjs http-serverAdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler6.1 Medium
- tugcantopaloglu openclaw-dashboard, openclaw agent dashboard +1 moreOpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field9.3 Critical
- ibm engineering requirements management doors and doors web access, engineering requirements management doors web access +1 moreIBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities6.1 Medium
- ibm sterling b2b integrator, sterling file gateway +1 moreXSS Security Vulnerability in response header affects IBM Sterling B2B Integrator and IBM Sterling File Gateway5.4 Medium
- ibm sterling b2b integrator, sterling file gateway +1 moreSecurity Vulnerability in Ebics server affects IBM Sterling B2B Integrator and IBM Sterling File Gateway5.4 Medium
- ibm tivoli system automation application manager, websphere application server +1 moreMultiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager9.3 Critical
- ibm tivoli system automation application manager, websphere application server +1 moreCross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager5.4 Medium
- dfir-iris iris-webDFIR-IRIS Stored XSS in Datastore Upload7.6 High
- dfir-iris iris-webDFIR-IRIS Stored XSS in Custom Attributes7.6 High
- dfir-iris iris-webDFIR-IRIS Stored XSS in Assets7.6 High
- goodlayers tourmasterTourmaster < 5.4.8 - Stored XSS via CSRF7.1 High
- unknown essential addons for elementorEssential Addons for Elementor - Lite < 6.6.10 - Contributor+ Stored XSS via Pricing Table Title Tag4.8 Medium
- unknown animation addons for elementorAnimation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload6.1 Medium
- unknown fluent formsFluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field6.1 Medium
- stellarwp givewpGiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings6.8 Medium
- unknown lifterlmsLifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information6.1 Medium
- unknown wp real ip-based access controlWP Real IP-based Access Control <= 1.3.1 - Unauthenticated Stored XSS via acl_ctrl_addr6.1 Medium
- broadcom spring tools, spring tools for eclipse +1 moreCross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips4.2 Medium
- google chromeInappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote...6.1 Medium
- google chromeInsufficient policy enforcement in Chromecast in Google Chrome prior to 151.0.7922.72 allowed an...5.4 Medium
- google chromeInappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote...6.1 Medium
- google chromeInappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote...6.1 Medium
- google chromeInappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote...6.1 Medium
- google chromeInappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote...6.1 Medium
- google chromeInappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote...6.1 Medium
- google chromeInappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote...6.1 Medium
- google chromeInsufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an...4.2 Medium
- google chromeInappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote...5.4 Medium
- google chromeInappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a...5.4 Medium
- No product listedcode-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the...6.1 Medium
- No product listedEcommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php.6.1 Medium
- No product listedCleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not...6.1 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab4.7 Medium
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.26.1 Medium
- rolandd ro csvi, rolandd.com ro csvi extension for joomla +1 moreJoomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.06.1 Medium
- ameliabooking booking system trafftBooking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- wpclever wpc badge management for woocommerceWPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute6.4 Medium
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member7.2 High
- duracelltomi gtm4wp – a google tag manager (gtm) plugin for wordpressGTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields7.2 High
- code4life database for cf7Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values7.2 High
- link libraryImproper neutralization of input during web page generation ('cross-site scripting')...6.4 Medium
- realmag777 wolfWOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF7.1 High
- unknown photoswipePhoto Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute6.8 Medium
- wpxpo wowstore – store builder & product blocks for woocommerceWowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute6.4 Medium
- wpxpo wowstore – store builder & product blocks for woocommerceWowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attribute6.4 Medium
- contrid newslettersNewsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute6.4 Medium
- it path solutions pvt ltd contact form to any apiContact Form to Any API <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta6.4 Medium
- contrid newslettersNewsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute6.4 Medium
- No product listedSourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) in...6.1 Medium
- Show moreLoading…