CWE-80: Basic XSS
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Also known as Improper Neutralization of Script-Related HTML Tags in a Web Page.
A kind of CWE-79 Cross-site Scripting.
From the CWE List. © The MITRE Corporation.
Newest
- qnap music stationCross-site Scripting Vulnerability in Music Station6.1 Medium
- qnap multimedia consoleCross-site Scripting Vulnerability in Multimedia Console6.1 Medium
- qnap photo stationCross-site Scripting Vulnerability in Photo Station6.1 Medium
- cisco webex meetingsCisco Webex Meetings API Cross-Site Scripting Vulnerability6.1 Medium
- puncsky touchbase.aiHTML Injection in touchbase.ai8.0 High
- qnap photo stationThe cross-site scripting vulnerability has been reported to affect earlier versions of Photo...6.1 Medium
- qnap photo stationThe cross-site scripting vulnerability has been reported to affect earlier versions of Photo...6.1 Medium
- qnap photo stationThe cross-site scripting vulnerability has been reported to affect earlier versions of Photo...6.1 Medium
- qnap music stationIf exploited, this SQL injection vulnerability could allow remote attackers to obtain application...7.5 High
- qnap music stationIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject...6.1 Medium
- qnap qts, network attached storage (nas) +1 moreIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject...6.1 Medium
- qnap qts, network attached storage (nas) +1 moreIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject...8.0 High
- fortinet fortimanager, fortianalyzer +1 moreAn improper neutralization of script-related HTML tags in a web page in FortiManager 6.2.0, 6.2.1...4.9 Medium
- siemens polarion subversion webclientA vulnerability has been identified in Polarion Subversion Webclient (All versions). The Polarion...6.1 Medium
- siemens sicam t, siemens ag sicam mmu, sicam sgu +3 more +5 moreA vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions)...6.1 Medium
- wordpress, debian linux, fedoraproject fedora +1 more +3 moreAuthenticated XSS via media attachment page in WordPress6.8 Medium
- wordpress, debian linux, fedoraproject fedora +1 more +3 moreAuthenticated self-XSS via theme uploads in WordPress2.4 Low
- wordpress, debian linux, fedoraproject fedora +1 more +3 moreAuthenticated XSS through embed block in WordPress5.4 Medium
- roundcube webmail, debian linux, fedoraproject fedora +2 moreAn issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS...6.1 Medium
- torchbox wagtailPossible XSS attack in Wagtail5.8 Medium
- siemens climatix pol908 (bacnet/ip module), climatix pol909 (awm module), climatix pol908 firmware +1 more +3 moreA vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions),...6.1 Medium
- viewvcXSS vulnerability in CVS show_subdir_lastmod support3.1 Low
- tiki-wiki groupware cms, tiki tikiwiki cms\/groupware +1 moreCross Site Scripting (XSS) flaws found in Tiki-Wiki CMS software6.5 Medium
- rails actionview, debian linux, fedoraproject fedora +1 more +3 morePossible XSS vulnerability in ActionView4.0 Medium
- siemens ag spectrum power™ 5, siemens spectrum power 5 +1 moreA vulnerability has been identified in Spectrum Power™ 5 (All versions < v5.50 HF02). The web...6.1 Medium
- siemens scalance s602, scalance s612, scalance s623 +5 more +7 moreA vulnerability has been identified in SCALANCE S602 (All versions >= V3.0), SCALANCE S612 (All...6.1 Medium
- matestack matestack-ui-core, ui-core +1 moreXSS/Script injection vulnerability in matestack7.7 High
- siemens xhqA vulnerability has been identified in XHQ (All versions < V6.0.0.2). The web interface could...5.4 Medium
- siemens ie/wsn-pa link wirelesshart gateway, ie\/wsn-pa link wirelesshart gateway firmware +1 moreA vulnerability has been identified in IE/WSN-PA Link WirelessHART Gateway (All versions). The...9.6 Critical
- nextcloud, nextcloud com.nextcloud.client +1 moreImproper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3...6.8 Medium
- zammadZammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The...6.1 Medium
- siemens spectrum power 3 (corporate user interface), spectrum power 4 (corporate user interface), spectrum power 5 (corporate user interface) +5 more +7 moreA vulnerability has been identified in Spectrum Power 3 (Corporate User Interface) (All versions ...6.1 Medium
- siemens simatic wincc (tia portal), simatic wincc runtime advanced, simatic wincc runtime professional +16 more +18 moreA vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1...5.4 Medium
- siemens scalance s602 firmware, scalance s612 firmware, scalance s623 firmware +2 more +4 moreA vulnerability has been identified in SCALANCE S602 (All versions < V4.0.1.1), SCALANCE S612 ...5.4 Medium
- accellion ftp serverThe Accellion FTP server prior to version FTA_9_12_220 is vulnerable to informaiton exposure6.1 Medium
- jqueryform php formmail generator, php formmail generator +1 morePHP forms generated using the PHP FormMail Generator are vulnerable to stored cross-site scripting6.1 Medium
- siemens scalance x-200 switch family (incl. siplus net variants), scalance x-200irt switch family (incl. siplus net variants), scalance x-200rna switch family +4 more +6 moreA vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) ...6.1 Medium
- shout project shout, hackerone shout node module +1 moreHTML Injection in shout6.1 Medium
- forms project forms, hackerone forms node module +1 moreCross-Site Scripting in forms6.1 Medium
- cogent datahub, cogentdatahub cogent datahub +1 moreCogent DataHub XSS7.1
- apache tomcatApache Tomcat's CookieExample Vulnerable to XSS4.3 Medium
- apache tomcatApache Tomcat SendMailServlet XSS4.3 Medium
- apache tomcatApache Tomcat XSS Vulnerability4.3 Medium
- simpbookCross-site scripting (XSS) vulnerability in SimpBook 1.0, with html_enable on (the default),...4.3 Medium
- apache strutsApache Struts Cross-site scripting Vulnerability4.3 Medium
- jettyJetty Javascript Inclusion Vulnerability5.8 Medium
- apache tomcatApache Tomcat allows webmasters to insert xss into error messages5.1 Medium