CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save_control7.7 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label8.4 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) in the Gallery block image Caption field8.5 High
- code-projects record management systemcode-projects Record Management System reg.php cross site scripting5.3 Medium
- developers italia design-scuole-wordpress-themeReflected XSS in WordPress theme design-scuole-wordpress-theme5.1 Medium
- unclecode crawl4aicrawl4ai before 0.9.3 DOM-based XSS via Playground UI5.1 Medium
- unclecode crawl4aicrawl4ai before 0.9.3 Cross-Site Scripting via innerHTML5.1 Medium
- jetmonsters motopress hotel bookingMotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'7.2 High
- qode bridge - creative multipurpose wordpress themeBridge - Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute6.4 Medium
- steedos steedos-platformSteedos Platform through 3.0.15-beta.47 Reflected XSS via page render5.3 Medium
- blueglassch job postingsJob Postings <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' Parameter6.4 Medium
- arraytics eventin – event calendar, tickets, registration, booking & woocommerceEventin <= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter6.4 Medium
- phpgurukul hostel management systemPHPGurukul Hostel Management System manage-students.php cross site scripting4.8 Medium
- governikus ausweisapp desktopGovernikus AusweisApp Desktop StartPAOSResponse cross site scripting5.3 Medium
- publishpress co-authors, multiple authors and guest authors in an author box with publishpress authorsCo-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix'…5.4 Medium
- roxnor shopengine elementor woocommerce builder addon – all in one woocommerce solution with ecommerce templates & woo widgetsThe ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sh…6.4 Medium
- phpgurukul daily expense tracker systemPHPGurukul Daily Expense Tracker System sidebar.php cross site scripting5.1 Medium
- No product listedBacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags.6.1 Medium
- No product listedBacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in the client address field.5.4 Medium
- No product listed1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file...6.5 Medium
- No product listedCross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows...6.1 Medium
- No product listedBharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the...5.4 Medium
- No product listedIn BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token,...5.3 Medium
- No product listedBharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the...6.1 Medium
- michaelliao itranswarpmichaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross site scripting5.1 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight)7.3 High
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications7.3 High
- jointakahe takaheTakahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme5.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Name7.3 High
- ibm sterling secure proxyIBM Sterling Secure Proxy is vulnerable to multiple issues5.4 Medium
- ibm cognos analyticsIBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities5.4 Medium
- apple ipados, macos, safari +3 more +5 moreA logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS...5.4 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon7.0 High
- ibm security verify access, security verify access container, verify identity access +1 more +3 moreSecurity vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access6.1 Medium
- ibm websphere application serverIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities5.4 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values7.0 High
- trilium trillium notesCVE-2026-910215.4 Medium
- wso2 api control plane, api manager +1 moreCross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution6.4 Medium
- itsourcecode loan management systemitsourcecode Loan Management System navbar.php cross site scripting5.3 Medium
- parallax filament-commentsparallax filament-comments through 3.0.0 Stored XSS via Comment Body9.3 Critical
- triplelift video-bundle.jsTripleLift video-bundle.js DOM-based XSS via postMessage2.3 Low
- mispMISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures5.1 Medium
- laradashboardLaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload5.1 Medium
- apache software foundation syncopeApache Syncope: Unauthenticated reflected XSS in Console and Enduser6.1 Medium
- code-projects inventory management systemSourceCodester Inventory Management System Product Management products_handler.php cross site scripting5.1 Medium
- code-projects inventory management systemSourceCodester Inventory Management System Vendor Management vendors_handler.php cross site scripting5.1 Medium
- code-projects inventory management systemSourceCodester Inventory Management System Customer Management customers_handler.php cross site scripting5.1 Medium
- contec co., ltd. sv-cpt-mc310, sv-cpt-mc310f +1 moreSolarView Compact contains a cross-site scripting vulnerability in Image Management. If this...5.1 Medium
- contec co., ltd. sv-cpt-mc310, sv-cpt-mc310f +1 moreSolarView Compact contains a cross-site scripting vulnerability in Schedule Settings and Mail...5.1 Medium
- contec co., ltd. can-2-usb, can-2-wf +1 moreCross-site scripting vulnerability exists in Contec CAN 2.0B Communication Wireless LAN / USB...4.8 Medium
- Show moreLoading…