CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- htplugins ht contact form – drag & drop form builder for wordpressHT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field7.2 High
- gestsupGestSup before 3.2.62 Stored XSS via Double-Decoded Email Subject in OAuth IMAP Connector5.3 Medium
- gestsupGestSup before 3.2.61 Stored XSS via Email Body in LOGIN IMAP Connector5.3 Medium
- No product listedCross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platform v.3...5.4 Medium
- cle-b httpdbghttpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL5.3 Medium
- eleveo call recording softwareEleveo Call Recording Software Play Audio audio.jsp cross site scripting5.1 Medium
- ordasoft book library, ordasoft.com book library (free) extension for joomla +1 moreJoomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.65.3 Medium
- ordasoft vehicle manager, ordasoft.com vehicle manager (free) extension for joomla +1 moreJoomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.85.3 Medium
- ordasoft real estate manager, ordasoft.com real estate manager (free) extension for joomla +1 moreJoomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.95.3 Medium
- suse rancherUnauthenticated update of public UI settings leading to stored cross-site scripting in Rancher9.6 Critical
- dayforce ess excelityMultiple Reflected XSS in Dayforce ESS Excelity5.1 Medium
- enocta educational technologies inc. platformHTML Injection in Enocta Educational's Enocta Platform4.1 Medium
- rolantis information technologies agentisHTML Injection in Rolantis Information Technologies' Agentis6.1 Medium
- tpvenlanube cloud web applicationStored Cross-Site Scripting (XSS) in TPVEnlanube4.8 Medium
- tpvenlanube cloud web applicationStored Cross-Site Scripting (XSS) in TPVEnlanube4.8 Medium
- tpvenlanube cloud web applicationStored Cross-Site Scripting (XSS) in TPVEnlanube4.8 Medium
- apache software foundation rollerApache Roller: Stored XSS in comment moderation via comment author URL6.1 Medium
- bimser solution software trade inc. eba plus document and workflow management systemStored XSS in BİMSER's eBA Plus5.4 Medium
- apache software foundation rollerApache Roller: Stored cross-site scripting in the authoring UI5.4 Medium
- apache software foundation rollerApache Roller: Reflected cross-site scripting in the frontpage directory parameter6.1 Medium
- apache software foundation rollerApache Roller: Stored cross-site scripting via uploaded media content type5.4 Medium
- apache software foundation rollerApache Roller: Stored cross-site scripting through incoming Trackback links6.1 Medium
- apache software foundation rollerApache Roller: Stored javascript: URI in HTML comments6.1 Medium
- apache software foundation rollerApache Roller: Reflected XSS in the optional LDAP comment authenticator6.1 Medium
- regularlabs tabs \& accordions, regularlabs.com tabs & accordions (free, pro) extension for joomla +1 moreJoomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.07.5 High
- amirsanni mini-inventory-and-sales-management-systemamirsanni mini-inventory-and-sales-management-system Items Management Items.php cross site scripting5.1 Medium
- krayin laravel-crmKrayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting4.8 Medium
- zhistaredu startrainingzhistaredu StarTraining application.yml cross site scripting2.1 Low
- zhistaredu startrainingzhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scripting5.1 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project registrationform.php cross site scripting5.3 Medium
- svenbluege event gallery, svenbluege.de event gallery for joomla +1 moreJoomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.05.3 Medium
- blubrry powerpress podcasting plugin by blubrryPowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block6.8 Medium
- ihomefinder optima express idxOptima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script6.8 Medium
- futtta wp youtube lyteWP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes6.8 Medium
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import6.8 Medium
- codename065 download managerDownload Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription8.8 High
- unknown embedpressEmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes6.8 Medium
- froxlorFroxlor before 2.3.12 Stored XSS via SSL certificate issuer9.3 Critical
- vrana adminerAdminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE5.3 Medium
- getgrav grav-plugin-datamanagerGrav Data Manager before 1.4.5 Stored XSS via item-detail view8.4 High
- siyuan-note siyuanSiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban8.6 High
- siyuan-note siyuanSiYuan before v3.8.4 Stored XSS via Attribute View textarea8.5 High
- siyuan-note siyuanSiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content8.6 High
- siyuan-note siyuanSiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL8.6 High
- wwbn avideoAVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field5.1 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting5.3 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scripting5.1 Medium
- optimoleOptimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block6.8 Medium
- unknown wp delicious, wp delicious delicious +1 moreWP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name6.8 Medium
- mndpsingh287 file manager, ninja team file manager pro, unknown fileorganizer +2 moreMultiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass7.5 High
- Show moreLoading…