CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- gramsearch telegram-searchtelegram-search Stored XSS via v-html in MessageList.vue8.2 High
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)7.7 High
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)8.7 High
- microsoft teams for android, teams +1 moreMicrosoft Teams for Android Spoofing Vulnerability8.8 High
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server subscription edition +1 more +3 moreMicrosoft Office SharePoint Spoofing Vulnerability9.3 Critical
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability4.6 Medium
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability4.6 Medium
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability7.3 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability4.6 Medium
- microsoft sharepoint server, sharepoint server 2019, sharepoint server subscription edition +2 moreMicrosoft SharePoint Server Elevation of Privilege Vulnerability7.3 High
- microsoft azure storage explorerAzure Storage Explorer Elevation of Privilege Vulnerability8.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability4.6 Medium
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Spoofing Vulnerability7.3 High
- microsoft sharepoint server, sharepoint server 2019, sharepoint server subscription edition +2 moreMicrosoft SharePoint Server Spoofing Vulnerability4.6 Medium
- microsoft sharepoint server 2019, sharepoint server subscription edition, sharepoint server +2 moreMicrosoft Office SharePoint Spoofing Vulnerability8.0 High
- activepiecesActivepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint6.1 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)4.6 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Cross-site Scripting (XSS) (CWE-79)8.8 High
- blackberry athoc iwsDOM-Based Cross-Site Scripting in BlackBerry AtHoc Web Portals5.3 Medium
- @swc html, swc-project swc, swc html minifier +2 moreSWC HTML minifier may allow script element breakout when minifying embedded JSON6.1 Medium
- maalfer pentestifyStored Cross-site Scripting in Pentestify finding severity field5.1 Medium
- wwbn avideoAVideo Stored Cross-Site Scripting via Unauthenticated Registration5.1 Medium
- daniel brendel hortusfoxDaniel Brendel HortusFox - Cross-Site Scripting5.4 Medium
- elkarte forum elkarteElkArte Forum ElkArte - Cross-Site Scripting5.4 Medium
- misp cti-transmutecti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search Highlighting5.1 Medium
- misp cti-transmutecti-transmute Stored XSS via Crafted Tag Icon on Admin Triage Interface5.1 Medium
- misp cti-transmutecti-transmute Saved Graph Configuration Allows Stored Cross-Site Scripting via svgIcon5.1 Medium
- misp cti-transmutecti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata2.3 Low
- misp cti-transmutecti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion Data5.3 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode6.4 Medium
- sap se netweaver application server abapCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP6.3 Medium
- sap se sapui5Cross Site Scripting (XSS) vulnerability in SAPUI56.1 Medium
- dataease sqlbotSQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html5.1 Medium
- xpf0000 flyenvFlyEnv < 4.18.0 Cross-Site Scripting via v-html5.3 Medium
- typemillTypemill CMS 2.x Persistent XSS via Markdown javascript URI4.6 Medium
- discourseDiscourse: Stored XSS chat-transcript username unescaped in Rich Text Editor8.7 High
- discourseDiscourse: Stored XSS in discourse-local-dates plugin2.0 Low
- hcl bigfix mobile, hclsoftware hcl bigfix mobile +1 moreHCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS)5.4 Medium
- discourseDiscourse: Stored XSS in the moderation review queue4.8 Medium
- discourseDiscourse: Stored XSS in staff action logs injects staff UI5.4 Medium
- discourseDiscourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing6.4 Medium
- misp cti-transmuteStored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Content5.1 Medium
- razinsoft ready ecommerceReadyEcommerce < 4.5.2 Stored XSS via Chat and Support Ticket Systems5.1 Medium
- magnolia dxp cmsStored XSS in Magnolia CMS5.1 Medium
- lobehub lobe-chatlobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload7.6 High
- fastschemafastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload5.4 Medium
- bluditBludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload5.4 Medium
- cube-root directory-servecube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename5.4 Medium
- cybozu, inc cybozu garoonCybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited,...6.0 Medium
- cristián lávaque s2members2Member < 260805 - Contributor+ Stored XSS via Shortcode6.8 Medium
- Show moreLoading…