CWE-80: Basic XSS
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Also known as Improper Neutralization of Script-Related HTML Tags in a Web Page.
A kind of CWE-79 Cross-site Scripting.
From the CWE List. © The MITRE Corporation.
Newest
- kutethemes techoneWordPress TechOne theme <= 3.0.3 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- mediawiki cargo, wikimedia foundation mediawiki - cargo extension +1 moreStored XSS through the dynamic table format in Cargo6.3 Medium
- mediawiki cargo, wikimedia foundation mediawiki - cargo extension +1 moreStored XSS through list fields on Cargo's page values and Special:CargoTables6.3 Medium
- mediawiki cargo, wikimedia foundation mediawiki - cargo extension +1 moreStored XSS through URLs in Cargo's map format6.3 Medium
- churchcrm, churchcrm crm +1 moreReflected XSS the login page through the 'username' parameter8.1 High
- papraPapra has an HTML Injection in Transactional Emails via Unescaped User Display Name4.3 Medium
- ibm aspera sharesMultiple vulnerabilities have been addressed in IBM Aspera Shares4.8 Medium
- powerdns dnsdistHTML injection in the web dashboard3.1 Low
- vowelweb ibtana – wordpress website builderIbtana - WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- home-assistant core, home-assistant +1 moreHome Assistant has stored XSS in Map-card through malicious device name7.3 High
- openbao, red hat cryostat 4 +1 moreOpenBao has Reflected XSS in its OIDC authentication error message9.4 Critical
- gitlabImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab7.7 High
- emilstenstrom justhtmljusthtml before 1.13.0 XSS via code fence breakout5.1 Medium
- openvessl anchorrAnchorr Privilege Escalation: Jellyseerr User → Anchorr Admin via Stored XSS9.1 Critical
- suitecrmSuiteCRM has blind XSS in return_id parameter5.9 Medium
- freescoutFreeScout: Stored XSS through SVG file upload with filter bypass8.5 High
- discourseDiscourse vulnerable to HTML injection via prohibited iframe URLs4.1 Medium
- johnbillion query monitorQuery Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI7.2 High
- filamentphp filamentFilament: Unvalidated Range and Values summarizer values can be used for XSS7.3 High
- vapor leafkit, leaf-kit +1 moreLeafKit's HTML escaping may be skipped for Collection values, enabling XSS6.9 Medium
- leanprover vscode-lean4XSS in @leanprover/unicode-input-component0.0 None
- chamilo lms, chamilo-lms +1 moreChamilo: Stored Cross-Site Scripting (XSS) in Chamilo LMS Exercise Feedback6.4 Medium
- cisco secure firewall adaptive security appliance (asa) software, secure firewall threat defense (ftd) software, secure firewall threat defense +1 more +3 moreCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Services Cross-Site Scripting Vulnerability6.1 Medium
- chamilo chamilo-lms, lms +1 moreChamilo: HTML injection via open parameter6.9 Medium
- chamilo chamilo-lms, lms +1 moreChamilo: Reflected XSS via page parameter5.1 Medium
- villatheme woocommerce photo reviewsWordPress WooCommerce Photo Reviews plugin <= 1.4.4 - Content Injection vulnerability5.3 Medium
- n8nn8n Vulnerable to Stored XSS via Various Nodes8.5 High
- go-vikunja vikunjaVikunja has Reflected HTML Injection via filter Parameter in Projects Module6.1 Medium
- kovah linkaceLinkAce: Stored XSS in Atom Feed via CDATA Escape in List Description8.7 High
- 8theme xstoreWordPress XStore theme <= 9.6.4 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- wpeverest everest formsWordPress Everest Forms plugin <= 3.4.1 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- ibm webmethods integration serverIBM webMethods Integration Server is vulnerable to HTML injection5.4 Medium
- go-vikunja vikunjaVikunja Affected by XSS Via Task Preview8.6 High
- gitlabImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab3.5 Low
- boldthemes bold page builderBold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode6.4 Medium
- openprojectOpenProject vulnerable to Stored HTML injection3.5 Low
- wintercms winterWinter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager0.0 None
- n8nn8n is Vulnerable to Stored Cross-Site Scripting via Markdown Rendering in Workflow UI8.5 High
- navidromeNavidrome is vulnerable to XSS via comment from song metadata6.1 Medium
- frappe erpnextERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks...4.1 Medium
cactiDebianA HTML injection vulnerability exists in the file upload functionality of Cacti <= 1.2.29. When a...5.4 Medium- xwiki, xwiki xwiki-platform, xwiki-rendering +2 moreXWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages6.5 Medium
- israpil textmetricsWordPress Textmetrics plugin <= 3.6.5 - Content Injection vulnerability4.3 Medium
- mwtemplates deepdigitalWordPress DeepDigital theme <= 1.0.2 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- xtemos woodmartWordPress WoodMart theme <= 8.3.7 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- ibm application gatewaySecurity vulnerabilities have been found in IBM Application Gateway5.4 Medium
- janobe e-learning systemSourceCodester E-Learning System Lesson index.php cross site scripting5.3 Medium
- anaconda dask, dask distributed +1 moreDask distributed Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard5.3 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Cross-Site Scripting Vulnerability4.8 Medium
- noor alam easy media downloadWordPress Easy Media Download plugin <= 1.1.11 - CSS Injection vulnerability5.4 Medium
- Show moreLoading…