CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- edimax br-6208acEdimax BR-6208AC QoS Page formQoS cross site scripting4.8 Medium
- frappe erpnextFrappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names8.5 High
- frappe erpnextFrappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages8.5 High
- frappe erpnextFrappe ERPNext before 15.110.0 Stored XSS via Item Record Name5.1 Medium
- frappe erpnextFrappe ERPNext before 15.112.0 Stored XSS via Public Portal Form5.3 Medium
- frappe erpnextFrappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name5.1 Medium
- frappe erpnextFrappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover8.5 High
- frappe erpnextFrappe ERPNext before 15.119.1 Stored XSS via Public Booking Page8.6 High
- frappe erpnextFrappe ERPNext before 15.120.0 Stored XSS via Report View8.5 High
- frappe erpnextERPNext before 15.112.0 Stored XSS via Tool View Record Names8.5 High
- elated-themes frappeFrappe before v16.31.0 Stored XSS via Dashboard Chart Filters5.1 Medium
- gohugoio hugoHugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs5.1 Medium
- frappe erpnextFrappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover8.6 High
- elated-themes frappeFrappe before 15.91.1 Stored XSS via Leaderboard User Names5.1 Medium
- elated-themes frappeFrappe before 15.4.0 XSS via Printview Parameters5.3 Medium
- elated-themes frappeFrappe before 14.31.0 HTML Injection via Weak Escaping5.1 Medium
- edimax br-6208acEdimax BR-6208AC Port Forwarding formPortFw cross site scripting4.8 Medium
- edimax br-6208acEdimax BR-6208AC HTTP Blocking formUrlb cross site scripting4.8 Medium
- qgisQGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values6.1 Medium
- edimax br-6208acEdimax BR-6208AC formFilter cross site scripting4.8 Medium
- netcore nr268Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting5.3 Medium
- netcore nr268Netcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scripting5.3 Medium
- zofe rapyd-adminRapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component5.3 Medium
- tianma-if edgeeverEdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview8.5 High
- tianma-if edgeeverEdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview8.4 High
- ibm db2 recovery expert for linux, unix and windowsDB2 Recovery Expert for Linux, UNIX and Windows Cross-Site Scripting6.1 Medium
- ibm db2 recovery expert for linux, unix and windowsIBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting6.1 Medium
- ibm db2 recovery expert for linux, unix and windowsIBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting6.1 Medium
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System Admin Record Tables user_record.php cross site scripting5.3 Medium
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System Student Registration add_student.php cross site scripting5.3 Medium
- leap13 premium addons for elementorWordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- expresstech quiz and survey masterWordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bdthemes element pack elementor addonsWordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- progress software corporation marklogic serverCross-site scripting in Progress MarkLogic Server6.1 Medium
- netcore nr268Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting4.8 Medium
- librenmsLibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List5.3 Medium
- librenmsLibreNMS before 26.9.0 Stored XSS via wireless sensor description5.3 Medium
- admidioAdmidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name5.3 Medium
- admidioAdmidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php5.1 Medium
- getgrav grav-plugin-guestbookGrav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views5.3 Medium
- craftcms cmsCraft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification2.1 Low
- open-webuiOpen WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds5.1 Medium
- open-webuiOpen WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url8.5 High
- open-webuiOpen WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview8.4 High
- open-webuiOpen WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links7.2 High
- imagemagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 XML Injection via CIP Encoder6.9 Medium
- pimcorePimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview5.1 Medium
- netis wf2409eNetis WF2409E Wireless Settings cross site scripting5.1 Medium
- theliaCVE-2026-1035276.1 Medium
- theliaCVE-2026-1035244.8 Medium
- Show moreLoading…