CWE-80: Basic XSS
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Also known as Improper Neutralization of Script-Related HTML Tags in a Web Page.
A kind of CWE-79 Cross-site Scripting.
From the CWE List. © The MITRE Corporation.
Newest
- cisco evolved programmable network manager (epnm), prime infrastructure, evolved programmable network manager +2 moreA vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco...4.8 Medium
- cisco identity services engine software, unified computing system (standalone), unified computing system e-series software (ucse) +6 more +8 moreA vulnerability in the web-based management interface of Cisco Integrated Management Controller ...6.1 Medium
- elementor website builder, unknown elementor website builder +1 moreElementor < 3.5.5 - Iframe Injection6.1 Medium
- google crittersXSS in Chrome Lab Critters5.7 Medium
- zoom meeting software development kit, video software development kit, zoom video communications, inc. sdk's +2 moreImproper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to...5.3 Medium
- zoom, zoom video communications, inc. desktop client for windows +1 moreImproper input validation in Zoom Desktop Client for Windows before 5.14.7 may allow an...9.6 Critical
- cisco small business ip phones, spa500ds firmware, spa500s firmware +10 more +12 moreA vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP...6.1 Medium
- cisco small business ip phones, spa500ds firmware, spa500s firmware +10 more +12 moreA vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone...5.8 Medium
- checkmkXSS in business intelligence5.4 Medium
- matrix-org matrix-react-sdkCross site scripting in Export Chat feature6.1 Medium
- o milesight, milesight milesightvpn +1 moreCross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device...4.7 Medium
- milesight milesightvpnCross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device...4.7 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to reflected cross-site scripting via delattachment action8.5 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters9.1 Critical
- codemiq wp html mail, a3rev wp email template +1 moreWP HTML Mail < 2.2.11 - HTML injection5.4 Medium
- oretnom23 lost and found information systemSourceCodester Lost and Found Information System Manage User Page cross site scripting2.4 Low
- abstrium pydio cellsAbstrium Pydio Cells Chat cross site scripting3.5 Low
- craftcms cms, craft cms +1 moreCraft CMS stored XSS in indexedVolumes5.5 Medium
- craftcms cms, craft cms +1 moreCraft CMS stored XSS in review volume5.5 Medium
- craftcms cms, craft cms, craftercms +2 moreCraftCMS stored XSS in Quick Post widget error message3.7 Low
- dfir-iris iris, iris-web +1 moreImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-web6.3 Medium
- palo alto networks pan-os, cloud ngfw, prisma access +2 morePAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface6.5 Medium
- esri portal for arcgisBUG-000155004 HTML injection issue in Portal for ArcGIS.5.4 Medium
- amazon fire tv stick 3rd gen, insignia tv with fireos, amazon fire os +2 moreThe setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter...4.3 Medium
- checkmk gmbh appliance, tribe29 checkmk appliance, checkmk appliance firmware +2 moreReflected Cross Site Scripting (XSS)6.1 Medium
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting8.9 High
- fortinet fortiauthenticatorAn improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in...4.2 Medium
- gov.uk govuk tech docsgovuk_tech_docs XSS Vulnerability6.1 Medium
- sap application interface framework (message monitoring), application interface +1 moreCode Injection vulnerability in SAP Application Interface Framework (Message Monitoring)3.7 Low
- sap application interface framework (message dashboard), application interface framework, basis +2 more +4 moreCode Injection vulnerability in SAP Application Interface Framework (Message Dashboard)3.7 Low
- bigfork silverstripe form capture, silverstripe-form-capture +1 moreSilverstripe Form Capture vulnerable to Stored Cross-Site Scripting6.1 Medium
- dizayn vira-investingXSS in Vira-Investing6.1 Medium
- itsourcecode student information management systemXSS in UBIT Information Technologies Student Information Management System6.1 Medium
- itsourcecode student information management systemXSS in UBIT Information Technologies Student Information Management System6.1 Medium
- kitabisa teler-wafteler-waf contains detection rule bypass via entities payload6.5 Medium
- kitabisa teler-wafteler-waf subject to bypass of common web attack threat rule with HTML entities payload6.5 Medium
- keycloak, redhat openshift container platform, single sign-on +2 moreHTML Injection in Keycloak Admin REST API5.4 Medium
- viewvcViewVC XSS vulnerability in revision view changed path "copyfrom" locations5.4 Medium
- mattkrick sanitize-svgsanitize-svg Filter Bypass Allows Cross-Site Scripting (XSS)7.6 High
- esri portal for arcgis, arcgis enterprise +1 moreHTML injection in accountswitcher-callback.html (10.9.1, 10.8.1 and 10.7.1 only)6.1 Medium
- mesosoi silverwaregames-io-issue-tracker, silverwaregames +1 moreHTML attributes when attaching a YouTube link to the post6.3 Medium
- lansweeperA stored cross-site scripting vulnerability exists in the HdConfigActions.aspx altertextlanguages...9.1 Critical
- siemens scalance x204rna (hsr), scalance x204rna (prp), scalance x204rna eec (hsr) +7 more +9 moreA vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE...6.1 Medium
- openedx xblock-drag-and-drop-v2Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields8.4 High
- glpi-project glpiStored Cross-Site Scripting (XSS) in user information in GLPI3.5 Low
- glpi-project glpiStored Cross-Site Scripting (XSS) through asset inventory in GLPI7.5 High
- glpi-project glpiCross-Site Scripting (XSS) in external links in GLPI4.5 Medium
- webminWebmin index.cgi cross site scripting3.5 Low
- twisted, debian linux +1 moreTwisted vulnerable to NameVirtualHost Host header injection5.4 Medium
- momofoolish sra-adminsra-admin is vulnerable to storage cross-site scripting (XSS) via unrestricted file upload8.2 High
- Show moreLoading…