CWE-80: Basic XSS
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Also known as Improper Neutralization of Script-Related HTML Tags in a Web Page.
A kind of CWE-79 Cross-site Scripting.
From the CWE List. © The MITRE Corporation.
Newest
- the wikimedia foundation mediawiki wikistories extensionVarious rawParams() and escaped() updates to prevent XSS in Wikistories extension0.3 Low
- the wikimedia foundation mediawiki readinglists extensionReadingLists imported metadata permits JavaScript URL XSS1.1 Low
- the wikimedia foundation mediawiki page forms extensionStored XSS through PageForms #autoedit redirect links1.2 Low
- the wikimedia foundation mediawiki wikiforum extensionStored XSS through system messages in WikiForum1.1 Low
- the wikimedia foundation mediawiki collection (book) extensionAPI permits session-seeded javascript URL XSS1.1 Low
- brainstorm force astra wordpress themeWordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability2.7 Low
- yahoo serialize-javascriptSerialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies2.3 Low
- flarum frameworkLaravel: XSS in Debug Page Information3.1 Low
- zammadZammad: Stored XSS via unescaped option labels in the object attribute options context UI5.3 Medium
- starcitizenwiki mediawiki-extensions-embedvideoMediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled7.5 High
- home-assistant coreHome Assistant: XSS in Statistics Graph Card9.3 Critical
- gocdGoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages7.5 High
- gocdGoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages7.0 High
- ibm cloud pak for business automationMultiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.5.4 Medium
- apache sparkApache Spark: XSS Vulnerability in Spark Web 3.5.46.1 Medium
- pretix venuelessDefault webserver configuration with incorrect CSP6.4 Medium
- privatebinPrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction4.3 Medium
- softtr informatics technology trading limited company e-commerce packHTML Injection in Softtr's E-Commerce Pack4.3 Medium
- cvat-ai cvatCVAT: Stored XSS via annotation guides in audio tasks8.5 High
- cisco industrial ethernet switchesCisco Industrial Ethernet 1000 Series Switches Stored Cross-Site Scripting Vulnerability5.4 Medium
- maalfer mailerupHTML Injection in MailerUp double opt-in verification email6.9 Medium
- webkul bagistoWebkul Bagisto Customer-Registration Notification Email register cross site scripting5.3 Medium
- alaev seo tools extensionAlaev SEO Tools Extension Popup UI popup.html addDiv cross site scripting5.3 Medium
- apache alluraApache Allura: XSS in markdown pipeline6.1 Medium
- apache alluraApache Allura: XSS in code display6.1 Medium
- thephpleague commonmarkLeague CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass5.3 Medium
- xdan joditJodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization5.3 Medium
- johnson controls fm systems employee, johnsoncontrols fms employee +1 moreFMS Employee Vulnerable to HTML Injection4.8 Medium
- apache jspwikiApache JSPWiki: Markdown parser allows XSS injection in Markdown error processing6.5 Medium
- calcom cal.diyCal.com through 4.7.15 Cross-Site Scripting via booking questions9.3 Critical
- calcom cal.diyCal.com through 4.7.15 Cross-Site Scripting via booking questions9.3 Critical
- datacycle-engine datacycle-coredataCycle Unauthenticated Reflected DOM XSS Via flash[...] On Public Pages6.1 Medium
- anglesharpAngleSharp: HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass6.9 Medium
plone-restapiPyPIplone.restapi: Stored XSS by spoofing mime type4.3 Medium- plone plone.app.textfieldplone.app.textfield: Stored XSS by spoofing mime type4.3 Medium
- lissy93 dashyDashy: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)5.9 Medium
- fortinet fortisiemA improper neutralization of script-related html tags in a web page (basic xss) vulnerability in...5.3 Medium
- chocobozzz peertubePeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)5.1 Medium
- siyuan-note siyuanSiYuan: Store XSS To Rce via Asset.render8.6 High
- yeswikiReflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki6.1 Medium
- yeswikiReflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki6.1 Medium
- armiya information technologies ltd. co. access control system (gks)HTML Injection in Armiya Technologies' Access Control System6.1 Medium
- professionalwiki mapsmediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function8.6 High
- ibm watsonx.data intelligenceVulnerabilities found in Watson Data Intelligence5.7 Medium
- apache tomcatApache Tomcat: XSS in number guess example6.1 Medium
- opal wp auros coreWordPress Auros Core plugin <= 5.3.1 - Content Injection vulnerability5.3 Medium
- pretixMalicious HTML content contained in the layout specification of a PDF ticket or badge layout was...8.8 High
- pretixMalicious HTML content could be injected into the page pretix shows when redirection to an...2.1 Low
- pretixContent injected to PDF rendering contexts could, in many places, include HTML content including ...2.1 Low
- pretixStored XSS in ticket confirmation page5.3 Medium
- Show moreLoading…