CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- combodo itopCombodo iTop: Reflected XSS in synchro/synchro_import.php8.0 High
- combodo itopCombodo iTop: Reflected XSS in dashboard save7.1 High
- combodo itopCombodo iTop: Reflected XSS in run_query.php8.0 High
- kepano defuddleDefuddle: XSS via unescaped attribute interpolation in site extractors8.2 High
- aws amazon opensearch service, opensearch dashboards dashboards-observability plugin +1 moreStored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards6.2 Medium
- combodo itopCombodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter7.3 High
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.58.6 High
- getgrav gravGrav before 2.0.20 Cross-Site Scripting via Assets Sandbox5.1 Medium
- tyrrrz discordchatexporterDiscordChatExporter: HTML attribute injection via unescaped emoji name in HTML export4.1 Medium
- tyrrrz discordchatexporterDiscordChatExporter: Stored XSS in HTML export when markdown formatting is disabled8.2 High
- element-hq element-webElement Web: A malicious homeserver can inject HTML in Element Web using its homepage5.3 Medium
- jet admin adminJet Admin Stored XSS8.5 High
- yootheme.com zoo extension for joomlaJoomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.668.6 High
- yootheme.com zoo extension for joomlaJoomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.665.3 Medium
- japan science and technology agency (jst) miraikan assist app android version, miraikan assist app ios version +1 moreCross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is...5.1 Medium
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting3.5 Low
- wpforms proWPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values7.2 High
- rocket.chatRocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10...7.5 High
- mauriceboe trekTREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner2.0 Low
- kovah linkaceLinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link API7.3 High
- bigbluebuttonBigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name5.4 Medium
- xapian xapian-coreA cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian...4.4 Medium
- dicebearDiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)4.7 Medium
- znunyZnuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.4.8 Medium
- shaarliShaarli vulnerable to stored XSS via raw bookmark title in document <title> element on public permalink page8.6 High
- wintercms winterWinter CMS: Reflected XSS through the search query parameter in the backend Table widget4.5 Medium
- wintercms winterWinter CMS: Stored XSS through cached Brand Settings and Editor Settings custom styles4.5 Medium
- wintercms winterWinter CMS: Stored XSS through Backend List widget image columns2.0 Low
- laravel-backpack crudbackpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted5.4 Medium
- laravel-backpack crudbackpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk4.4 Medium
- coderCoder before 2.34.2 Stored HTML Injection via Appearance Settings4.8 Medium
- django cms association django-cmsdjango CMS: Stored XSS in edit-mode plugin exception rendering4.4 Medium
- automattic mongooseMongoose: Reflected XSS via decoded URI in directory listing render5.4 Medium
- automattic mongooseMongoose: Stored XSS via unescaped filenames in directory listing5.4 Medium
- atutorReflected XSS in ATutor4.8 Medium
- atutorReflected XSS in ATutor4.8 Medium
- atutorStored XSS in ATutor5.1 Medium
- hakan ozevin wp base bookingWordPress WP BASE Booking plugin <= 6.3.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- notificationx proWordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- monkeysan flatasticWordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- 10web form maker by 10webWordPress Form Maker by 10Web plugin <= 1.15.49 - Cross Site Scripting (XSS) vulnerability7.1 High
- eric teubert podlove podcast publisherWordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- seo squirrly plugin by squirrly seoWordPress SEO Plugin by Squirrly SEO plugin <= 14.2.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- thembay aoraWordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability7.1 High
- paymob for woocommerceWordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- themehunk advance product searchWordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- themegrill smartsmtpWordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- hasthemes swatchly – woocommerce variation swatches for productsWordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability7.1 High
- paolo geodirectoryWordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerability7.1 High
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…