CWE-80: Basic XSS
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Also known as Improper Neutralization of Script-Related HTML Tags in a Web Page.
A kind of CWE-79 Cross-site Scripting.
From the CWE List. © The MITRE Corporation.
Newest
- wondercmsA cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows...4.6 Medium
- combodo itopiTop vulnerable to XSS in dashlet modifications ajax endpoints6.8 Medium
- combodo itopiTop vulnerable to XSS in friendlyname in object details5.7 Medium
- tcpdf project tcpdfTCPDF Cross-site Scripting vulnerability6.1 Medium
- acquia mauticXSS in Notifications via saving Dashboards4.8 Medium
- acquia mauticXSS Cross-site Scripting Stored (XSS) - Description field7.6 High
- ayecode userswp, stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp +1 moreUsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- checkmkXSS in graph rendering4.6 Medium
- esri portal for arcgis, arcgis enterprise web app builder +1 moreHTML injection in ArcGIS Web AppBuilder4.7 Medium
- hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 moreShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal P…6.4 Medium
- cisco small business rv series router firmware, rv016 firmware, rv042 firmware +4 more +6 moreA vulnerability in the web-based management interface of Cisco Small Business RV016, RV042,...6.1 Medium
- munyweki insurance management systemCross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a...6.3 Medium
- supermicro x11sae-f firmware, x11sse-f firmware, x11ssm-f firmware +2 moreAn issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker...8.3 High
- phpmyfaqphpMyFAQ Stored HTML Injection at contentLink4.7 Medium
- bmc control-mHTML injection in BMC Control-M4.6 Medium
- webedition cmsWebedition CMS 9.2.2.0 has a Stored XSS vulnerability via /webEdition/we_cmd.php.6.3 Medium
- anzhiyu-c hexo-theme-anzhiyuhexo-theme-anzhiyu Cross-site Scripting vulnerability6.1 Medium
- mozilla firefox, firefox for ios +1 moreUsing an AMP url with a canonical element, an attacker could have executed JavaScript from an...7.1 High
- getkirby kirby, kirby cms +1 moreWithdrawn Advisory: Kirby CMS HTML injection vulnerability7.1 High
- enhavoEnhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field...5.4 Medium
- mhenrixon sidekiq-unique-jobsCross-site Scripting sidekiq-unique-jobs UI server vulnerability7.1 High
- contribsys sidekiqCross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to...6.1 Medium
- contribsys sidekiqCross Site Scripting vulnerability in Contribsys Sidekiq6.1 Medium
- kubernetes apiserverRancher API Server Cross-site Scripting Vulnerability8.3 High
- rancher normanNorman API Cross-site Scripting Vulnerability8.3 High
- elated-themes frappeFrappe Authenticated Reflected Cross site scripting (XSS) in portal pages5.4 Medium
- phpmyfaqphpMyFAQ vulnerable to stored XSS on attachments filename6.5 Medium
- suluSulu is vulnerable to HTML Injection via Autocomplete Suggestion2.7 Low
- ibm powerscIBM PowerSC HTML injection6.1 Medium
- statamic cms, statamic +1 moreStatamic account takeover via XSS and password reset link8.2 High
- facilemanagerfacileManager Systemic Cross-Site Scripting (XSS)5.4 Medium
- apollographql apollo-client-nextjs, apollo client +1 moreXSS in @apollo/experimental-nextjs-app-support8.2 High
- gitlabImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab6.4 Medium
- dolibarr, dolibarr erp\/crm +1 moreDolibarr Application Home Page HTML injection vulnerability7.1 High
- cisco prime infrastructure, evolved programmable network manager (epnm), evolved programmable network manager +2 moreA vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow...4.8 Medium
- nia rrj nueva ecija engineer online portal, rrj nueva ecija engineer online portal +1 moreRRJ Nueva Ecija Engineer Online Portal NIA Office students.php cross site scripting2.4 Low
- xwiki, xwiki xwiki-platform +1 moreReflected Cross-site scripting through revision parameter in content menu in XWiki Platform9.7 Critical
- pimcore admin classic bundle, admin-ui-classic-bundle +1 morePimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews6.1 Medium
- fogprojectFOG stored XSS on log screen via unsanitized request logging5.4 Medium
- zzzcmsZZZCMS Personal Profile Page cross site scripting3.5 Low
- peplink surf soho hw1, surf soho firmware +1 moreA stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of...3.4 Low
- fortinet fortiosAn improper neutralization of script-related html tags in a web page (basic xss) in Fortinet...3.9 Low
- piwigoPiwigo Reflected XSS vulnerability9.3 Critical
- red hat ansible automation platform 2.3 for rhel 8, ansible automation platform 2.3 for rhel 9, ansible automation platform 2.4 for rhel 8 +5 more +7 moreController: html injection in custom login info7.3 High
- cisco sd-wan vmanageA vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly...4.3 Medium
plone-restapiPyPIplone.restapi vulnerable to Stored Cross Site Scripting with SVG image in user portrait3.7 Low- zopeZope vulnerable to Stored Cross Site Scripting with SVG images3.7 Low
- plone namedfile, plone.namedfile +1 moreplone.namedfile vulnerable to Stored Cross Site Scripting with SVG images3.7 Low
- adobe connectXSS in Saphira Connect6.1 Medium
- ninjaforms ninja forms contact formNinja Forms < 3.6.26 - Admin+ Stored HTML Injection4.8 Medium
- Show moreLoading…