CWE-80: Basic XSS
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Also known as Improper Neutralization of Script-Related HTML Tags in a Web Page.
A kind of CWE-79 Cross-site Scripting.
From the CWE List. © The MITRE Corporation.
Newest
- home-assistant coreHome Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name8.5 High
- hcl software maxai assistantHCL MaxAI Assistant is susceptible to a HTML injection vulnerability4.6 Medium
- christophrado cookie notice & consentCookie Notice & Consent <= 1.6.5 - Unauthenticated Stored Cross-Site Scripting7.2 High
- flowiseFlowise - Cross-Site Scripting in Chat Messages and Agent Workflows5.1 Medium
- hcl software myxalytics, hcltech dryice myxalytics +1 moreHCL MyXalytics is affected by an HTML Injection4.6 Medium
- No product listedYoast SEO Premium 25.7-25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- joni1802 ts3 manager, ts3-manager +1 moreTS3 Manager is vulnerable to unauthenticated reflected XSS attack due to insecure error handling4.3 Medium
- discourseDiscourse is vulnerable to XSS when quoting chat messages3.5 Low
- michaellow eulerpool research systemsEulerpool Research Systems <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- 8theme xstoreWordPress XStore theme < 9.6 - Content Injection vulnerability5.3 Medium
- cozythemes cozy blocksWordPress Cozy Blocks Plugin <= 2.1.29 - Content Injection Vulnerability5.3 Medium
- strategy11 team awp classifiedsWordPress AWP Classifieds plugin <= 4.4.3 - Content Injection vulnerability5.3 Medium
- jason c. memberlite shortcodesMemberlite Shortcodes <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- knadh listmonklistmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover8.6 High
- cisco unified computing system (managed), unified computing system (standalone), unified computing system e-series software (ucse) +2 moreCisco Integrated Management Controller Virtual Keyboard Video Monitor (vKVM) Stored Cross-Site Scripting Vulnerability5.4 Medium
- valvepress wordpress automatic pluginWordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.118.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting4.7 Medium
- No product listedHTML injection vulnerability in the registration interface in Evolution Consulting Kft. HRmaster...7.0 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature5.2 Medium
- shaarliShaarli allows reflected XSS via searchtags parameter7.1 High
- namelessmc namelessNamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editor9.1 Critical
- namelessmc namelessNamelessMC allows Stored Cross Site Scripting (XSS) in SEO component7.2 High
- apache supersetApache Superset: Stored XSS on charts metadata5.3 Medium
- radiustheme classified listingWordPress Classified Listing Plugin plugin <= 5.0.0 - Content Injection Vulnerability5.4 Medium
- odn mosaic generatorMosaic Generator <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'c' Parameter6.4 Medium
- cisco identity services engine software, ise passive identity connector +1 moreCisco Identity Services Engine Stored Cross-Site Scripting Vulnerabiliy5.4 Medium
- humhub files, cfiles +1 moreFiles is Vulnerable to Reflected Self-XSS through its File Move Functionality5.1 Medium
- 9001 copypartycopyparty Reflected XSS via Filter Parameter6.3 Medium
- glpi-project glpiGLPI is vulnerable to XSS and open redirection attacks through planning feature6.5 Medium
- glpi-project glpiGLPI is susceptible to Stored XSS attack through project's kanban4.5 Medium
- ibm informix dynamic serverIBM Informix Dynamic Server HTML injection5.4 Medium
- axiomthemes anubisAnubis accepts crafted redirect URLs in pass-challenge 'Try Again' buttons5.1 Medium
- mozilla firefox, thunderbird +1 morejavascript: URLs executed on object and embed tags8.1 High
- xwiki, xwiki xwiki-rendering +1 moreXWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax9.1 Critical
- sap se businessobjects business intelligence platform (web intelligence)HTML Injection vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)4.1 Medium
- n-media frontend file managerWordPress Frontend File Manager plugin <= 23.6 - Content Injection vulnerability4.6 Medium
- ibm cloud pak systemIBM Cloud Pak System HTML injection5.4 Medium
- starcitizentools mediawiki-extensions-tabberneueTabberNeue vulnerable to Stored XSS through wikitext8.6 High
- ibm cloud pak systemIBM Cloud Pak System HTML injection5.4 Medium
- filebrowserFile Browser has Stored Cross-Site Scripting vulnerability7.6 High
- codename065 download managerDownload Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode6.4 Medium
- gitlabImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab8.7 High
- haxtheweb issues, psu haxcms-nodejs, haxcms-php +2 moreHax CMS Stored Cross-Site Scripting vulnerability8.5 High
- andreyk paged galleryPaged Gallery <= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- suse manager server module 4.3, container suse/manager/5.0/x86 64/server:5.0.4.7.19.1 +1 moreReflected XSS in spacewalk-java5.6 Medium
- ibm aspera faspexIBM Aspera Faspex HTML injection5.4 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Stored Cross-Site Scripting Vulnerability4.8 Medium
- ibm content navigatorIBM Content Navigator HTML injection5.4 Medium
- emmanuelg eg-seriesEG-Series <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- codework subpage listSubpage List <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpspeedo team members showcaseTeam Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- Show moreLoading…