CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- unknown real3d flipbookReal3D Flipbook Lite < 5.4 - Author+ Stored XSS6.8 Medium
- onsite internet gmbh auktion ng auktionssoftwareonSite internet GmbH Auktion NG Auktionssoftware Public Password Reset Endpoint forgotpasswd.html cross site scripting5.3 Medium
- sourcecodester smart attendance system with qr code scannerSourceCodester Smart Attendance System with QR Code Scanner Self-Registration student_signup.php prepend cross site scripting5.3 Medium
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities8.2 High
- github enterprise serverStored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline7.4 High
- autonomy logic openplc runtimeImproper Neutralization of Input During Web Page Generation in OpenPLC Runtime v35.3 Medium
- macwarrior clipbucket-v5ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters5.3 Medium
- unleashUnleash: CR-approval email renders user-controlled raw HTML2.1 Low
- nautobotNautobot: Stored cross-site scripting (XSS) in object create/edit form help text5.4 Medium
- adobe aem 6.5 forms jee, aem 6.5 lts forms jee +1 moreAdobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)8.1 High
- adobe connect, connect android mobile app, connect for mobile +2 moreAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)9.3 Critical
- adobe connect, connect android mobile app, connect for mobile +2 moreAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)6.1 Medium
- adobe connect, connect android mobile app, connect for mobile +2 moreAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)9.3 Critical
- adobe connect, connect android mobile app, connect for mobile +2 moreAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)9.3 Critical
- adobe connect, connect android mobile app, connect for mobile +2 moreAdobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)9.3 Critical
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Reflected XSS in OAuth Setup Callback Handler5.4 Medium
- dgtlmoon changedetection.iodgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting5.1 Medium
- hkuds lightragLightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content6.1 Medium
- novuhq novuNovu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme5.1 Medium
- mispMISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View4.8 Medium
- mispMISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON5.1 Medium
- sfturing hosp ordersfturing hosp_order Public Search Handlers HospitalController.java cross site scripting5.3 Medium
- mispMISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List5.1 Medium
- mispMISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread4.8 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI7.6 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint7.5 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Stored XSS via TLS peer-certificate DN in management UI7.3 High
- wpclever wpc product bundles for woocommerceWPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter7.2 High
- jgwhite33 wp yelp review sliderWP Yelp Review Slider <= 9.2 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)7.2 High
- prasunsen hostelHostel <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_currency' Parameter and Localization file URL Setting4.4 Medium
- livecomposer live composer – free wordpress website builderLive Composer <= 2.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content6.4 Medium
- unknown ninja formsNinja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin8.8 High
- kstover ninja forms – contact form builder with calculators, quizzes, signatures & ai form builderNinja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting7.2 High
- cozmoslabs translatepress – translate multilingual sites with ai translationTranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel7.2 High
- unknown text stylerText Styler <= 1.1.1 - Contributor+ Stored XSS6.8 Medium
- wpdevelop booking calendarBooking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter6.1 Medium
- ajay contextual related postsContextual Related Posts <= 4.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameter6.4 Medium
- No product listedMCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content...8.7 High
- No product listedA reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface...4.7 Medium
webpyDebianwebpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().6.1 Medium- xuxueli xxl-jobxuxueli xxl-job insert cross site scripting5.1 Medium
- discourseDiscourse: Stored XSS via unescaped actor name in post actions5.4 Medium
- laurent22 joplinJoplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl4.4 Medium
- laurent22 joplinJoplin: Stored XSS via inline-served note attachment on published shares7.6 High
- laurent22 joplinJoplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer7.7 High
- tautulliTautulli: Reflected XSS in `/search` endpoint5.1 Medium
- tautulliTautulli: Stored Cross-Site Scripting (XSS) in the newsletter4.8 Medium
- warp-tech warpgateWarpgate: Markup injection in SSO form_post return page via unencoded redirect/error values2.4 Low
- warp-tech warpgateWarpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter9.3 Critical
- telegram desktopTelegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is...8.3 High
- Show moreLoading…