CWE-80: Basic XSS
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Also known as Improper Neutralization of Script-Related HTML Tags in a Web Page.
A kind of CWE-79 Cross-site Scripting.
From the CWE List. © The MITRE Corporation.
Newest
- spwebguy responsive pricing tableResponsive Pricing Table <= 5.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'table_currency'6.4 Medium
- audrasjb key figuresKey Figures <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting via kf_field_figure_default_color_render4.4 Medium
- opajaap wp photo album plusWP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting7.1 High
- ibm aspera faspex 5, aspera faspex +1 moreXSS in IBM Aspera Faspex5.4 Medium
- nestornoe amazon affiliate lite pluginAmazon affiliate lite Plugin <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- colabrio stockie extraWordPress Stockie Extra plugin <= 1.2.11 - Content Injection vulnerability6.5 Medium
- colabrio norebro extraWordPress Norebro Extra plugin <= 1.6.8 - Content Injection vulnerability5.3 Medium
- danny-avila librechatLibreChat JSON Injection in Chat POST Allows Remote Resource Inclusion and PXSS via Image Upload8.6 High
- xwiki, xwiki xwiki-platform +1 moreXWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication6.5 Medium
- sevenspark contact form 7 – dynamic text extensionWordPress Contact Form 7 Dynamic Text Extension plugin <= 5.0.5 - Content Injection vulnerability5.3 Medium
- thinkinai deepchatDeepChat's Incomplete XSS Fix Allows RCE through Mermaid Content9.7 Critical
- grandstream gxp1625Grandstream GXP1625 Network Status api.values.post cross site scripting5.1 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud5.4 Medium
- datateam datactiveStored XSS in Datateam's Datactive4.8 Medium
- apache skywalkingApache SkyWalking: Stored XSS vulnerability6.1 Medium
- astroAstro is vulnerable to Reflected XSS via the server islands feature7.1 High
- fortinet fortiadcA improper neutralization of script-related html tags in a web page (basic xss) vulnerability in...4.2 Medium
- hidekazu ishikawa vk all in one expansion unitVK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- hidekazu ishikawa vk all in one expansion unitVK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- aveva application serverAVEVA Application Server IDE Basic Cross-site Scripting7.2 High
- bdtask wholesale, wholesale inventory control and inventory management system +1 moreBdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System edit_profile cross site scripting5.1 Medium
- bdtask saleserpBdtask/CodeCanyon SalesERP User Profile edit_profile cross site scripting5.1 Medium
- desktopalert pingalert application serverA Stored Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop...6.5 Medium
- desktopalert pingalert application serverA Reflected Cross Site Scripting (XSS) vulnerability was found in the Application Server of...7.6 High
- sagortouch chart expertChart Expert <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- mitegvg slippy slider – responsive touch navigation sliderSlippy Slider – Responsive Touch Navigation Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting5.4 Medium
- ibm openpagesIBM OpenPages Vulnerable to HTML Injection5.4 Medium
- realmag777 tableonWordPress TableOn plugin <= 1.0.5.1 - Content Injection vulnerability7.1 High
- easy appointments appointments, easyappointments easy appointments +1 moreWordPress Easy Appointments plugin <= 3.12.14 - Content Injection vulnerability6.5 Medium
- spacetime ad inserter – ad manager & adsense adsAd Inserter <= 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field6.4 Medium
- brecht visual link previewVisual Link Preview <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via visual-link-preview Shortcode6.4 Medium
- galetteGalette is vulnerable to XSS through Document Type5.3 Medium
- octoprintOctoPrint is vulnerable to XSS through Action Command Notifications and Prompts4.6 Medium
- checkmkCross Site Scripting through compromised remote site8.5 High
- privatebinPrivateBin persistent HTML injection in attachment filename enables redirect and defacement5.8 Medium
- suse manager server lts 4.3, container suse manager 5.0 +1 morespacewalk-java has various XSS issues on search page9.3 Critical
- ibm openpagesHTML Injection Vulnerability in a Specific URL Endpoint of the IBM OpenPages Application5.4 Medium
- jthemes xsmartWordPress xSmart theme <= 1.2.9.4 - Content Injection vulnerability4.3 Medium
- brecht wp recipe makerWordPress WP Recipe Maker plugin < 10.1.0 - Content Injection vulnerability5.3 Medium
- hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 moreShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- cnaveenkumar multi item responsive sliderMulti Item Responsive Slider <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- eclipse vert.xVert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names2.3 Low
- amentotech doctreatWordPress Doctreat theme <= 1.6.7 - Content Injection vulnerability6.3 Medium
- bagistobagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)6.9 Medium
- bagistobagisto - Cross Site Scripting (XSS) in Create New Customer6.9 Medium
- bagistobagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)6.9 Medium
- hcl software bigfix mobile, hcltech bigfix modern client management +1 moreHCL BigFix Mobile is affected by an insecure Content Security Policy (CSP)6.5 Medium
- hcl software bigfix modern client management, hcltech bigfix mobile +1 moreHCL BigFix Modern Client Management (MCM) is affected by an insecure Content Security Policy (CSP)6.5 Medium
- wpbakery page builderWPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via vc_custom_heading Shortcode6.4 Medium
- wpbakery page builderWPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via Custom JS Module6.4 Medium
- Show moreLoading…