CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- contec co., ltd. pc-helper wireless i/o dio-0404ry-lwf, pc-helper wireless i/o dio-0404ry-lwf-us +1 moreCross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and PC-HELPER...4.8 Medium
- contec co., ltd. fxa3000, fxa3000-[][], fxa3020 +17 more +19 moreCross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000...4.8 Medium
- contec co., ltd. cpsl-08p1enCross-site scripting vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an...5.1 Medium
- contec co., ltd. programmable remote i/o coupler unit (software plc type) cpsn-pcb271-s1-041, remote i/o coupler unit (ethernet/ip adapter) cpsn-eob471ei-[]1, remote i/o coupler unit (server type) cpsn-mcb271-* +2 moreCross-site scripting vulnerability exists in CONPROSYS nano Series. If this vulnerability is...5.1 Medium
- contec co., ltd. configurable type cps-pcs341[][]-ds1-1201, integrated type cps-pc341[][]-*-9201 +1 moreCross-site scripting vulnerability exists in CONPROSYS PAC Series. If this vulnerability is...5.1 Medium
- contec co., ltd. m2m controller configurable type cps-mcs341*, m2m controller integrated type cps-mc341, m2m gateway configurable type cps-mgs341* +1 more +3 moreCross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M...5.1 Medium
- contec co., ltd. ece1000, ece1020, ecs1020 +2 moreCross-site scripting vulnerability exists in Contec EC1000 series. If this vulnerability is...4.8 Medium
- contec co., ltd. rp-wah-sr1, rp-wah-sr12, rp-wah-sr2 +1 more +3 moreCross-site scripting vulnerability exists in Contec RP-WAH-SR Series. If this vulnerability is...4.8 Medium
- contec co., ltd. sga1000Cross-site scripting vulnerability exists in SGA1000. If this vulnerability is exploited, an...4.8 Medium
- regularlabs.com articles anywhere (pro) extension for joomla, users anywhere (pro) extension for joomla +1 moreJoomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.05.3 Medium
- regularlabs.com snippets (free) extension for joomla, snippets (pro) extension for joomla +1 moreJoomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.0.07.5 High
- regularlabs.com quick index (free, pro) extension for joomlaJoomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.57.5 High
- regularlabs.com modals (free, pro) extension for joomlaJoomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.07.5 High
- regularlabs.com articles anywhere (free, pro) extension for joomlaJoomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.07.5 High
- regularlabs.com modals (pro) extension for joomlaJoomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.07.5 High
- regularlabs.com tabs & accordions (free, pro) extension for joomlaJoomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.07.5 High
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System subject1.php cross site scripting5.3 Medium
- mediawiki massmessageAn issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special...5.4 Medium
- elated-themes frappeFrappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages.6.1 Medium
- paessler prtg network monitorA bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520.7.2 High
- totolink a3002muTotolink A3002MU Anchor Tag cross site scripting5.1 Medium
- anil-matcha open-generative-aiAnil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting5.1 Medium
- embeds for youtube plugin support youtube embedYouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_server8.8 High
- unknown hoo companionHoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings Import8.8 High
- kagisearch smallwebkagisearch smallweb Query String Rendering sw.py index cross site scripting5.3 Medium
- exrick xmallExrick xmall Order Printing order-print.jsp cross site scripting5.3 Medium
- linlinjava litemalllinlinjava litemall Product Detail index.vue AdminGoodsService.validate cross site scripting4.8 Medium
- linlinjava litemalllinlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scripting4.8 Medium
- moxi624 mogu blog v2moxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort cross site scripting5.1 Medium
- quequnlong shiyi-blogquequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting5.1 Medium
- quequnlong shiyi-blogquequnlong shiyi-blog chat sendMsg Endpoint index.vue SysChatMsgMapper.getChatMsgList cross site scripting5.1 Medium
- maliangnansheng bbs-springbootmaliangnansheng bbs-springboot ArticleController.java utils.toToc cross site scripting5.1 Medium
- dataeaseDataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting5.1 Medium
- tduckapp tduck-platformTDuckApp tduck-platform Form Write View index.vue cross site scripting5.1 Medium
- quequnlong shiyi-blogquequnlong shiyi-blog Add Message API index.vue cross site scripting5.3 Medium
- amundsen-io amundsen-frontendAmundsen Frontend through 4.3.0 Stored XSS via Description8.3 High
- strapiStrapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG9.3 Critical
- stilleshan serverstatusstilleshan ServerStatus Stats Generation main.cpp cross site scripting5.1 Medium
- fengoffice feng officeFengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting5.1 Medium
- getgrav gravGrav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of...1.8 Low
- repetico web backendA Cross-Site Scripting (XSS) vulnerability in the web backend for the Repetico app 1.9.7.31 for...5.4 Medium
- xuxueli xxl-jobXuxueli xxl-job insert cross site scripting5.1 Medium
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter6.4 Medium
- unknown yaypricingYayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route8.0 High
- unknown wp highlight boxWP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box Shortcode6.8 Medium
- unknown masteriyo lmsMasteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course Highlights6.8 Medium
- unknown be rest endpointsBE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation8.8 High
- unknown export & import wpbakery page builderExport & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRF7.1 High
- unknown custom menu wizard widgetCustom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes6.8 Medium
- webkul qloappsQloApps through 1.7.0 Reflected XSS via List Filter Parameters5.1 Medium
- Show moreLoading…