CWE-80: Basic XSS
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Also known as Improper Neutralization of Script-Related HTML Tags in a Web Page.
A kind of CWE-79 Cross-site Scripting.
From the CWE List. © The MITRE Corporation.
Newest
- ibm cognos analyticsIBM Cognos Analytics HTML injection5.4 Medium
- mantrabrain learning management system, elearning, course builder, wordpress lms plugin – sikshya lmsLearning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS <= 0.0.21 - Reflected Cross-Site Scripting via page Parameter6.1 Medium
- contact form - repute infosystems arforms form builderWordPress ARForms plugin <= 1.7.1 - HTML Injection vulnerability5.3 Medium
- gvectors wpforo forumWordPress wpForo plugin <= 2.2.5 - Broken Access Control + CSRF vulnerability4.3 Medium
- directusDirectus has an HTML Injection in Comment5.7 Medium
- kanboardKanboard allows a persistent HTML injection site scripting in settings page date format5.5 Medium
- hcltechsw hcl devops deploy, hcl launch, hcl software devops deploy / launch +2 moreHCL DevOps Deploy / HCL Launch is vulnerable to HTML injection3.1 Low
- issuetrakAuthenticated HTML Injection in Issuetrak Ticket Comment Function5.1 Medium
- 2fauth2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/preview7.5 High
- 2fauth2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render6.1 Medium
- django cms association filerFile Upload Bypass in django Filer5.5 Medium
- cisco webex teamsCisco Webex Teams Web Interface Cross-Site Scripting Vulnerability5.4 Medium
- mapster wp mapsMapster WP Maps <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- cisco webex meetingsCisco Webex Meetings Cross-Site Scripting Vulnerability6.1 Medium
- xwiki pdf viewer macro, xwikisas macro-pdfviewer, macro pdfviewer +2 moremacro-pdfviewer has a XSS through the width parameter9.1 Critical
- cmanon wp-stravaWP-Strava <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting6.1 Medium
- saleswonder team tobias cf7 wow stylerWordPress CF7 WOW Styler plugin <= 1.6.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- fullworks simple shortcode for google mapsSimple Shortcode for Google Maps <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- cisco asyncos, secure email, secure email and web manager +1 more +3 moreCisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Stored Cross-Site Scripting Vulnerabilities5.4 Medium
- j3ssie osmedeusStored Cross-site Scripting to RCE on Osmedeus Web Server8.7 High
- octoprintJinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrint5.5 Medium
- bna pospratikHTML Injection in Bna Informatics' PosPratik6.9 Medium
- mkucej i-librarian-freeI, Librarian has a Stored XSS vulnerability in Supplemental Files4.6 Medium
- seur oficial oficial, seuroficial seur oficial +1 moreSEUR Oficial <= 2.2.11 - Reflected Cross-Site Scripting6.1 Medium
- cisco adaptive security appliance (asa) software, adaptive security appliance software, firepower threat defense software +1 more +3 moreA vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA)...6.1 Medium
- cisco adaptive security appliance (asa) software, adaptive security appliance software, firepower threat defense software +1 more +3 moreCisco Adaptive Security Appliance WebVPN Cross-Site Scripting Vulnerability6.1 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section4.2 Medium
- omardabbas eu/uk vat manager for woocommerce, wpfactory eu\/uk vat manager for woocommerce +1 moreWordPress EU/UK VAT Manager for WooCommerce plugin <= 2.12.14 - CSRF to Cross Site Scripting (XSS) vulnerability7.1 High
- cisco ata 191 firmware, ata 192 firmware, analog telephone adaptor (ata) software +2 moreCisco ATA 190 Series Analog Telephone Adapter Firmware Reflected Cross-Site Scripting Vulnerability6.1 Medium
- f5 big-iq, big-iq centralized management +1 moreF5 BIG-IQ Vulnerability4.8 Medium
- miraheze incidentreportingCross-site Scripting in IncidentReporting6.0 Medium
- miraheze importdumpCross-site Scripting (XSS) on Special:RequestImportQueue when displaying request date in ImportDump6.0 Medium
- miraheze wikidiscoverCross-site Scripting (XSS) in Special:WikiDiscover when displaying wiki information in WikiDiscover7.6 High
- esri portal for arcgisBUG-000161683 - HTML injection vulnerability in Portal for ArcGIS.5.4 Medium
- jgniecki minecraft motd parser, minecraftmotdparser +1 moreMinecraft MOTD Parser's HtmlGenerator vulnerable to XSS6.9 Medium
- miraheze datadumpXSS in Special:DataDump when displaying dump status3.5 Low
- wpmu dev - your all-in-one wordpress platform broken link checkerBroken Link Checker <= 2.4.0 - Reflected Cross-Site Scripting7.1 High
- starcitizen.tools citizen, starcitizentools mediawiki-skins-citizen +1 morestarcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field4.8 Medium
- bizswoop store hours for woocommerceStore Hours for WooCommerce <= 4.3.20 - Reflected Cross-Site Scripting6.1 Medium
- dvankooten mc4wp: mailchimp for wordpress, ibericode mailchimp +1 moreMailChimp for Wordpress <= 4.9.16 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- te informatics v5Reflected XSS in TE Informatics' V5 Software8.8 High
- craftcms cms, craft cms +1 moreCraft CMS stored XSS in breadcrumb list and title fields5.5 Medium
- checkmkXSS in view page with SLA column4.8 Medium
- classcmsClassCMS Article admin cross site scripting5.1 Medium
- kirstyburgoine responsive videoResponsive Video <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- priorityPriority – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)6.1 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform XSS through conflict resolution9.1 Critical
- mashovMashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)6.1 Medium
- twistedHTML injection in HTTP redirect body6.1 Medium
- getsentry sentrySentry vulnerable to stored Cross-Site Scripting (XSS)7.1 High
- Show moreLoading…