CWE-79: Cross-site Scripting
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Also known as Improper Neutralization of Input During Web Page Generation, XSS, HTML Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- semanticmediawiki, semantic-mediawiki semantic mediawiki +1 moreSemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile5.3 Medium
- semanticmediawiki, semantic-mediawiki semantic mediawiki +1 moreSemanticMediaWiki 2.5.0 before 7.3.1 Stored XSS via Special:Browse Code Property5.3 Medium
- semanticmediawiki, semantic-mediawiki semantic mediawiki +1 moreSemanticMediaWiki 3.2.0 before 7.3.1 Stored XSS via Special:Browse Group Heading4.8 Medium
- semantic-mediawiki semantic mediawiki, semanticmediawiki +1 moreSemantic MediaWiki 3.0.0 before 7.3.1 Stored XSS via Special:Browse Keyword Property5.3 Medium
- semantic-mediawiki semantic mediawiki, semanticmediawiki +1 moreSemantic MediaWiki before 7.3.1 Stored XSS via External Identifier in Special:Browse5.3 Medium
- semantic-mediawiki semantic mediawiki, semanticmediawiki +1 moreSemantic MediaWiki before 7.3.1 Reflected XSS via Special:SMWAdmin id Parameter5.3 Medium
- semanticmediawiki, semantic-mediawiki semantic mediawiki +1 moreSemanticMediaWiki 5.0.0 before 7.3.1 Stored XSS via Tooltip Module data-* Attributes5.3 Medium
- semantic-mediawiki semantic mediawiki, semanticmediawiki +1 moreSemantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions4.8 Medium
- semantic-mediawiki semantic mediawiki, semanticmediawiki +1 moreSemantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels4.8 Medium
- semantic-mediawiki semantic mediawiki, semanticmediawiki +1 moreSemantic MediaWiki 3.0.0 before 7.3.1 XSS via Property-Value Autocomplete5.3 Medium
- semanticmediawiki, semantic-mediawiki semantic mediawiki +1 moreSemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator Parameters5.3 Medium
- semanticmediawiki, semantic-mediawiki semantic mediawiki +1 moreSemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter5.3 Medium
- sisense cloud bi platformMultiple vulnerabilities in Sisense’s Cloud BI Platform8.3 High
- deconf analytics insights – google analytics dashboard for wordpressAnalytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title7.2 High
- saruf-ratul hr-payroll-management-systemSaruf-Ratul HR-Payroll-Management-System chat.php cross site scripting5.1 Medium
- md-mafujul-hasan online-payroll-management-systemMD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scripting5.1 Medium
- ubiquiti inc airmax mA malicious actor with access to the adjacent network and under certain conditions could exploit...8.8 High
- yeswikiYesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler5.3 Medium
- yeswikiYesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback5.3 Medium
- cure53 dompurifyDOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees5.1 Medium
- No product listedArgilla TextField.vue cross site scripting4.8 Medium
- No product listedArgilla Sandbox.vue cross site scripting4.8 Medium
- No product listedArgilla Settings SettingsInfo.vue Dataset.from_disk cross site scripting5.1 Medium
- itsourcecode airline reservation systemitsourcecode Airline Reservation System book_flight.php cross site scripting5.3 Medium
- lxsmnsyc serovalSeroval: Code injection through a typed array's own constructor property5.3 Medium
- lxsmnsyc serovalSeroval: Script injection through RegExp sources in serialized output4.7 Medium
- subhajitkhan online-clinic-management-systemsubhajitkhan online-clinic-management-system patientregistration.php cross site scripting5.1 Medium
- wolfvision cynap pro, cynap core pro, cynap receiver, cynap pure, cynap pure mini, cynap pure pro, cynap pure (next gen), cynap bridge, cynap videobar +1 more +3 moreStored Cross-Site Scripting in Web Interface5.1 Medium
- asterisk, asterisk certified-asterisk +1 moreAsterisk: Reflected XSS in Phone Provisioning HTTP Error Pages2.3 Low
- esri arcgis serverBUG-000187164 - ArcGIS Server has a security vulnerability.6.1 Medium
- esri arcgis serverBUG-000187165 - ArcGIS Server has a security vulnerability.6.1 Medium
- esri arcgis serverBUG-000185167 - ArcGIS Server has a security vulnerability.6.1 Medium
- wp chill gallery photoblocksWordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins typing text – give your texts many typing effectsWordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins button blockWordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins content slider blockWordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bdtask garage 24 garage management softwareBdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting5.1 Medium
- bplugins lightbox blockWordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp chill gallery photoblocksWordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ameliabooking ameliaWordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mganss htmlsanitizerHtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes2.3 Low
- francoisjacquet rosariosisRosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php5.3 Medium
- webasyst frameworkWebasyst Framework through 4.4.0 Stored XSS via Photos Album URL5.1 Medium
- No product listedA stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integrati…8.2 High
- crocoblock jetsmartfiltersWordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins advanced post block - post grid for wordpress block editorWordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins panorama viewer – 360 degree image + video viewerWordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins b sliderWordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetelements for elementorWordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cyberhobo geo mashupWordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…