CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- code-projects online shopping systemcode-projects Online Shopping System Newsletter Subscription offersmail.php cross site scripting5.3 Medium
- joomshaper.com helix ultimate extension for joomlaJoomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.118.6 High
- apache wicketApache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue6.1 Medium
- apache wicketApache Wicket: XSS in Palette via getAdditionalAttributes5.1 Medium
- apache wicketApache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel5.1 Medium
- apache wicketApache Wicket: XSS in MetaDataHeaderItem via addTagAttribute5.1 Medium
- apache wicketApache Wicket: XSS in Button via its model object5.1 Medium
- apache wicketApache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel5.1 Medium
- apconw aix-dbAix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown5.1 Medium
- yaojingang geoflowyaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting5.3 Medium
- code-projects simple inventory systemcode-projects Simple Inventory System User Registration register.php cross site scripting5.3 Medium
- nokia nspA Stored Cross-Site Scripting (XSS) Vulnerability in Nokia NSP5.4 Medium
- code-projects employee leave managing systemcode-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting5.1 Medium
- ash-project ash adminStored XSS in AshAdmin relationship typeahead via unescaped label_field content8.4 High
- seacmsSeaCMS err.php cross site scripting5.3 Medium
- No product listedStored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208...5.4 Medium
- No product listedTechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application...6.1 Medium
- codekernel queue management systemSourceCodester Queue Management System add_customer.php cross site scripting5.3 Medium
- siyuan-note siyuanSiYuan before v3.8.1 Stored XSS via block name9.3 Critical
- siyuan-note siyuanSiYuan before v3.8.1 Stored XSS via confirmDialog9.3 Critical
- wwbn avideoWWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php5.3 Medium
- readestReadest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution8.8 High
- beetel 450tc3Beetel 450TC3 User Management cross site scripting5.1 Medium
- coppermine photo gallery photo gallery, coppermine-gallery coppermine photo gallery +1 morecoppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting5.1 Medium
- coppermine photo gallery photo gallery, coppermine-gallery coppermine photo gallery +1 morecoppermine-gallery Coppermine Photo Gallery edit_profile Endpoint profile.php cross site scripting5.1 Medium
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg < 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio Field8.8 High
- unknown mw wp formMW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data List3.5 Low
- ivole customer reviews for woocommerceCustomer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored XSS via 'comment' Parameter8.8 High
- unknown geotargetingwpGeotargeting WP < 3.5.6.2 - Reflected XSS7.1 High
- unknown sogo add script to individual pages header footerSOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox6.8 Medium
- getformwork formworkFormwork < 2.3.11 Stored XSS via Referer Header5.3 Medium
- unknown user profile builderProfile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode6.8 Medium
- silverstripe silverstripe-versionedSilverstripe Versioned: XSS in archive admin restore5.4 Medium
- privatebinPrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction4.3 Medium
- mongodb mongosql transition readiness tool, bi connector transition readiness report +1 moreMongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports6.9 Medium
- mongodb bi connector transition readiness report, mongosql transition readiness tool +1 moreMongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata4.8 Medium
- yamcsYamcs: DOM XSS in Extension Routing4.3 Medium
- yamcsYamcs: Reflected XSS in the URL of the Authorize Endpoint6.5 Medium
- akilli ticaret software technologies ltd. e-commerce packStored XSS in Akıllı Ticaret's E-Commerce Pack5.4 Medium
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- ceviz informatics inc. web designReflected XSS in Ceviz Informatics's Web Design6.1 Medium
- dayneks software industry and trade inc. e-commerce platformReflected XSS in Dayneks Software's E-Commerce Platform6.1 Medium
- ivole customer reviews for woocommerceCustomer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form7.2 High
- wp media rocketWP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint7.2 High
- smub envira gallery – image photo gallery, albums, video gallery, slideshows & moreEnvira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description6.4 Medium
- digital-peak.com dp calendar extension for joomlaJoomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.07.5 High
- mrvinoth.com all video share extension for joomlaJoomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.05.3 Medium
- stellarwp givewp – donation plugin and fundraising platformGiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- servmask all-in-one wp migration unlimited extensionAll-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter6.4 Medium
- synology chat serverAn improper neutralization of input during web page generation ('Cross-site Scripting')...6.5 Medium
- Show moreLoading…