CWE-80: Basic XSS
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Also known as Improper Neutralization of Script-Related HTML Tags in a Web Page.
A kind of CWE-79 Cross-site Scripting.
From the CWE List. © The MITRE Corporation.
Newest
- pretix pretix-pagesStored XSS in pretix-pages2.1 Low
- pretix pretix-digitalStored XSS in pretix-digital2.0 Low
- gogsGogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS5.4 Medium
- octoprintOctoPrint: XSS in Suppressed Command Notifications4.6 Medium
- apache atlasApache Atlas: Stored XSS in Create Entity page5.4 Medium
- radware cyber controllerRadware Cyber Controller HTML Report Generation HTML injection5.1 Medium
gogs.io/gogsGoGogs: XSS in .ipynb files renderer due to outdated notebookjs8.5 High- starcitizenwiki mediawiki-extensions-embedvideoEmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled7.5 High
- starcitizenwiki mediawiki-extensions-embedvideoEmbedVideo Extension : Stored XSS via unsanitized class passed to template8.6 High
- starcitizenwiki mediawiki-extensions-embedvideoEmbedVideo Extension: Stored XSS via unsanitized service name in exception text7.5 High
- astroAstro: Reflected XSS via unescaped slot name7.1 High
- apache answerApache Answer: HTML Content Injection in Email5.4 Medium
- bolt cmsBolt CMS HTML Attribute TextType.php HTML injection5.1 Medium
- scadabrScadaBR Unauthenticated Reflected Cross-Site Scripting6.1 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Unsanitized vhost names allow for XSS in management UI5.6 Medium
- spabrice nylaWordPress Nyla theme <= 1.7 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- backdropcms gdpr cookies module for backdrop cmsThe GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect...1.8 Low
- commenthol md-fileservermd-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)7.2 High
- convoypanel panelCtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML Output4.8 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Stored Cross-Site Scripting in SVG Renderer5.1 Medium
- interactivegeomaps mapgeo – interactive geo mapsMapGeo - Interactive Geo Maps <= 1.6.27 - Reflected Cross-Site Scripting via 'map' Parameter6.1 Medium
- cvat-ai cvatCVAT: Stored XSS via annotation guides8.5 High
- efwgrp efw4.xefw4.X: Stored XSS via previewServlet4.6 Medium
- microsoft visual studio codeVisual Studio Code Remote Code Execution Vulnerability7.8 High
- invoicing payments plugin getpaidWordPress GetPaid Plugin 2.4.6 HTML Injection via Help Text5.1 Medium
- grimmory-tools grimmoryGrimmory: Stored XSS via Malicious EPUB Enables Session Token Theft6.3 Medium
- mapserverMapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewer6.1 Medium
- th30d4y ip, w4nn4d13\/ip +1 moreth30d4y/IP: DOM-Based Cross-Site Scripting (XSS) Vulnerability6.1 Medium
- divvydrive information technologies inc. divvydriveHTML Injection in DivvyDrive Information Technologies' DivvyDrive8.8 High
- weblateWeblate is vulnerable to XSS via crafted Markdown4.3 Medium
- hcl dfxanalyticsHCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability3.1 Low
- yafnetYAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread Viewers7.3 High
- yafnetYAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header8.1 High
@tdurieux/anonymous_githubnpm@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin8.1 High- phpoffice phpspreadsheetPhpSpreadsheet XSS via number format text substitution in HTML Writer4.8 Medium
- mailcow mailcow-dockerizedmailcow: dockerized vulnerable to stored XSS in user login history real_rip7.0 High
- mailcow mailcow-dockerizedmailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames8.9 High
- mailcow mailcow-dockerizedmailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field9.3 Critical
- pega platform, pegasystems pega infinity +1 morePega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role.5.1 Medium
- cisco webex contact centerA vulnerability in the Desktop Agent functionality of Cisco Webex Contact Center could have...6.1 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality6.5 Medium
- 1panel-dev maxkbMaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering5.1 Medium
- espocrmEspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field4.6 Medium
- No product listedA HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0. The...6.1 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM has an XSS vulnerability5.3 Medium
- zammadZammad improperly neutralizes of script-related HTML tags in ticket articles5.3 Medium
- tagdiv composerWordPress tagDiv Composer plugin <= 5.4.3 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- kutethemes uminexWordPress Uminex theme <= 1.0.9 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- kutethemes dukamarketWordPress DukaMarket theme <= 1.3.0 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- kutethemes armaniaWordPress Armania theme <= 1.4.8 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- Show moreLoading…