CWE-80: Basic XSS
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Also known as Improper Neutralization of Script-Related HTML Tags in a Web Page.
A kind of CWE-79 Cross-site Scripting.
From the CWE List. © The MITRE Corporation.
Newest
- ankitects ankiAn reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in...7.4 High
- ibm security qradar edrIBM Security ReaQta HTML injection5.4 Medium
- khojPrompt Injection triggered XSS vulnerability in Khoj Obsidian, Desktop and Web clients5.9 Medium
- eskooly web productCross Site Scripting vulnerability in Eskooly Web Product v.3.0 and before allows a remote...5.4 Medium
- vmware cloud directorVMware Cloud Director Availability contains an HTML injection vulnerability. A malicious actor...6.4 Medium
- checkmkXSS in SQL check parameters6.5 Medium
- mermaid-js zenuml-coreCross-site Scripting in ZenUML5.4 Medium
- checkmkXSS in Crash Report Page4.8 Medium
- checkmkXSS in confirmation pop-up5.4 Medium
- anchorcms anchor, anchor cms +1 moreCross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute...6.1 Medium
- playsmsplaySMS New Phonebook cross site scripting5.1 Medium
- gvectors wpforo forumWordPress wpForo Forum plugin <= 2.0.9 - Auth. HTML Injection vulnerability4.3 Medium
- ez-suite ez-partnerEZ-Suite EZ-Partner Forgot Password cross site scripting6.9 Medium
- genexis tilgin home gatewayGenexis Tilgin Home Gateway Login cross site scripting6.9 Medium
- checkmkXSS in inventory view6.5 Medium
- ibarn project ibarnzhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS)...6.3 Medium
- verint wfo, workforce optimization +1 moreVerint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)6.1 Medium
- automattic woocommerceWooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms5.4 Medium
- No product listedplaySMS SMS Schedule cross site scripting5.3 Medium
- gurgunday ghtmlghtml Cross-Site Scripting (XSS) vulnerability8.9 High
- yith woocommerce product add-ons, yithemes yith woocommerce product add-ons +1 moreWordPress YITH WooCommerce Product Add-Ons plugin <= 4.9.2 - Content Injection vulnerability5.3 Medium
- sulu suluformbundleTokenController formName not sanitized in hidden input6.1 Medium
- railsActionText ContentAttachment can Contain Unsanitized HTML6.1 Medium
- vsourz digital responsive slick slider wordpressWordPress Responsive Slick Slider WordPress plugin <= 1.4 - Content Injection vulnerability6.5 Medium
- tips and tricks hq stripe payments, tipsandtricks-hq accept stripe +1 moreWordPress Accept Stripe Payments plugin <= 2.0.79 - Content Injection vulnerability5.3 Medium
- ari soft stream quizWordPress ARI Stream Quiz – WordPress Quizzes Builder plugin <= 1.3.2 - Content Injection vulnerability5.4 Medium
- gvectors wpdiscuzWordPress wpDiscuz plugin <= 7.6.10 - Content Injection vulnerability5.3 Medium
- unknown responsive tabsWordPress Responsive Tabs plugin < 4.0.6 - HTML Content Injection vulnerability5.4 Medium
- pluginever wp content pilot – autoblogging & affiliate marketing pluginWordPress WP Content Pilot plugin <= 1.3.3 - HTML Injection vulnerability4.3 Medium
- pickplugins tabs & accordionWordPress Tabs & Accordion plugin <= 1.3.10 - Content Injection vulnerability5.4 Medium
- marketing fire discussion boardWordPress Discussion Board plugin <= 2.4.8 - Content Injection vulnerability5.4 Medium
- brainstorm force spectraWordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Unauthenticated Email HTML Injection Vulnerability5.3 Medium
- openprojectStored Cross-Site Scripting (XSS) in OpenProject7.6 High
phpxmlrpc/extrasPackagistphpxmlrpc/extra XSS in class documenting_xmlrpc_server6.1 Medium- strategy11 formidable formsWordPress Formidable Forms plugin <= 6.7 - Content Injection vulnerability5.3 Medium
- bill minozzi car dealerWordPress cardealer plugin <= 4.15 - Content Injection vulnerability2.7 Low
- codepeople cp polls, polls cp +1 moreWordPress Polls CP plugin <= 1.0.71 - Content Injection vulnerability5.3 Medium
- supsystic pricing table by supsysticWordPress Pricing Table by Supsystic plugin <= 1.9.12 - Content Injection vulnerability4.3 Medium
- gztimewalker gzctfGZ::CTF allows unprivileged user can perform XSS attacks by constructing malicious team names.6.5 Medium
- froxlorFroxlor Vulnerable to Blind XSS Leading to Froxlor Application Compromise9.7 Critical
- mediawiki, fedoraproject fedora +1 moreAn issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7...7.4 High
- wordpressWordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar...7.2 High
- static-web-serverStored Cross-site Scripting in directory listings via file names in static-web-server5.8 Medium
- cmsimpleCross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers...7.4 High
- ymfe yapiA stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module...7.4 High
- crocoblock jetformbuilderWordPress JetFormBuilder plugin <= 3.1.4 - Content Injection vulnerability5.3 Medium
- metagauss registrationmagicWordPress RegistrationMagic plugin <= 5.1.9.2 - Content Injection5.3 Medium
- gohugo hugoHugo doesn't escape markdown title in internal render hooks6.1 Medium
- aio-libs aiohttp, fedoraproject fedora +1 moreaiohttp vulnerable to XSS on index pages for static file handling6.1 Medium
- excalidrawexcalidraw vulnerable to a Stored XSS in excalidraw's web embed component6.1 Medium
- Show moreLoading…