CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- louislam uptime-kumaUptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages8.1 High
- openshwprojects openbk7231t appOpenBK7231T - Reflected XSS via OTA host Parameter5.4 Medium
- openshwprojects openbk7231t appOpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels8.5 High
- 299ko299Ko - Unauthenticated Reflected XSS in Public Contact Form6.1 Medium
- grocyGrocy - Stored XSS via HTMLPurifier Output Double-Decode8.7 High
- invoiceninjaInvoiceNinja - Stored XSS via Invoice/Quote Terms Field8.7 High
- smub smash balloon social photo feed – easy social feeds pluginSmash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String4.7 Medium
- alphawolf simple yearly archiveSimple Yearly Archive <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- sonalsinha21 skt skill barSKT Skill Bar <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- cozmoslabs translatepress – translate multilingual sites with ai translationTranslatePress <= 3.2.5 - Reflected Cross-Site Scripting6.1 Medium
- sevenspark dtx – dynamic text extension for contact form 7Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting4.4 Medium
- seraphinitesoft seraphinite acceleratorSeraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting6.1 Medium
- superpwa super progressive web appsSuper Progressive Web Apps <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting4.4 Medium
- paolo geodirectoryGeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories3.5 Low
- unknown wp custom html pageWP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS5.4 Medium
- unknown orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & moreOrbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload6.1 Medium
- unknown bit formBit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload7.5 High
- antoineh football poolFootball Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting6.1 Medium
- e4jvikwp vikrentitems flexible rental management systemVikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting7.2 High
- tryghost ghostGhost: Cross-Site Scripting in Universal Import5.0 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages8.7 High
- cvat-ai cvatCVAT has stored XSS via annotation guide assets8.5 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin8.2 High
- snomed international snowstormSNOMED International Snowstorm reflected XSS2.3 Low
- google @a2ui/web core, a2ui\/web core +1 moreArbitrary JavaScript Execution via openUrl in @a2ui/web_core6.1 Medium
- perspective-dev perspectivePerspective 5.0.0 XSS via Debug Plugin innerHTML Interpolation5.1 Medium
- pegasystems pega infinityPega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.4.6 Medium
- bilin software and informatics consultancy inc. humanist digital human resourcesStored XSS in Bilin Software's HUMANIST Digital Human Resources5.4 Medium
- blubrry powerpress podcasting plugin by blubrryBlubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL6.8 Medium
- themefusecom brizyBrizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point6.8 Medium
- themefusecom brizyBrizy - Page Builder < 2.8.19 - Author+ Stored XSS via brizy_set_project Global Project Code Asset3.5 Low
- unknown nested pagesNested Pages < 3.2.15 - Editor+ Stored XSS via Post Title4.8 Medium
- unknown quiz and survey master (qsm)Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar Question4.8 Medium
- No product listedA reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10...6.1 Medium
- No product listedCross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63...6.1 Medium
- microweberMicroweber CMS 2.0.20 Stored XSS via tag_names Parameter4.8 Medium
- No product listedOpenAkita File Upload API upload cross site scripting2.3 Low
- deciso opnsenseOPNsense < 26.1.9 Stored XSS via Certificate Description Field5.1 Medium
- deciso opnsenseOPNsense < 26.1.9 Stored XSS via Firewall Rule Description Field5.1 Medium
- lud oaskitReflected XSS in oaskit's default HTML error handler5.1 Medium
- @angular compiler, angular, @angular core +2 moreAngular i18n: Cross-Site Scripting (XSS) via event-handler attributes7.6 High
- @angular platform-server, angular +1 moreAngular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)8.6 High
- open-emr openemrOpenEMR 8.2.0 Stored XSS via import_template.php Template Management4.8 Medium
- hp inc designjet t3500HP DesignJet T3500 - Potential Cross-Site Scripting (XSS)6.9 Medium
- admidioAdmidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint6.9 Medium
- flowintelStored Cross-Site Scripting via Vue Template Injection in FlowIntel6.9 Medium
- unknown simple membershipSimple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name6.1 Medium
- meril inc. blog floating buttonBlog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header6.1 Medium
- unknown svg supportSVG Support < 2.5.17 - Author+ Stored XSS via .svgz Sanitization Bypass6.1 Medium
- No product listedEmlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article...5.4 Medium
- Show moreLoading…