CWE-87: Improper Neutralization of Alternate XSS Syntax
The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
A kind of CWE-79 Cross-site Scripting.
From the CWE List. © The MITRE Corporation.
Newest
- invoiceplane InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms 4.8 Medium
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 more Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior... 5.3 Medium
- significant-gravitas autogpt AutoGPT SignUp Page has DOM-Based XSS and Open Redirect 8.8 High
- getkirby kirby Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()` 8.5 High
- tinacms @tinacms/mdx, tinacms +1 more TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes 4.8 Medium
- apache answer Apache Answer: XSS in AI Answer Rendering 6.1 Medium
- commenthol md-fileserver md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed) 7.2 High
- openwebui open webui, open-webui +1 more Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image 7.4 High
- openmage magento-lts Magento LTS: Reflected XSS - Import -> Data Flow (profiles) 5.3 Medium
- n8n n8n: XSS via MCP OAuth client 8.8 High
- dnnsoftware dotnetnuke, dnn.platform +1 more DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload 8.1 High
- elemntor elementor website builder – more than just a page builder Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API 6.4 Medium
- the wikimedia foundation mediawiki - wikilove extension Stored XSS through system messages in WikiLove 6.9 Medium
- churchcrm, churchcrm crm +1 more ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection 7.6 High
- homarr DOM-Based XSS in Homarr /auth/login Redirect 8.8 High
- yeswiki YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter" 7.1 High
- ory polis DOM-Based XSS in Ory Polis Login Page 8.8 High
- chamilo chamilo-lms, lms +1 more Chamilo: Reflected XSS via page parameter 5.1 Medium
- vapor leaf-kit, leafkit +1 more Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster 6.1 Medium
- contao Contao is vulnerable to cross-site scripting in templates 3.3 Low
- galette Galette is vulnerable to Cross-site Scripting 5.3 Medium
- bagisto bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG) 6.9 Medium
- bagisto bagisto - Cross Site Scripting (XSS) in Create New Customer 6.9 Medium
- bagisto bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML) 6.9 Medium
- ovatheme ova advent Ova Advent <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 6.4 Medium
- shaarli Shaarli allows reflected XSS via searchtags parameter 7.1 High
- node-saml Node-SAML SAML Authentication Bypass 9.3 Critical
- intermesh group-office, groupoffice +1 more Group-Office vulnerable to blind XSS 5.2 Medium
- haxtheweb issues, psu haxcms-nodejs, haxcms-php +2 more Hax CMS Stored Cross-Site Scripting vulnerability 8.5 High
- forceu gokapi Gokapi has stored XSS vulnerability in friendly name for API keys 4.8 Medium
- forceu gokapi Gokapi vulnerable to stored XSS via uploading file with malicious file name 4.8 Medium
- intermesh group-office, groupoffice +1 more GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions 6.9 Medium
- openwebui open webui, open-webui +1 more Open WebUI vulnerable to limited stored XSS vila uploaded html file 5.3 Medium
- vega Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] 5.3 Medium
- connekthq ajax load more, dcooney ajax load more – infinite scroll, load more, & lazy load +1 more WordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label Parameter 6.4 Medium
- rengine reNgine vulnerable to Stored Cross-Site Scripting (XSS) via DNS Record Poisoning 5.0 Medium
- themesflat addons for elementor Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Titles 6.4 Medium
- khl32 font farsi Font Farsi <= 1.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting 4.4 Medium
- brainstorm force ultimate addons for elementor, brainstormforce elementor header \& footer builder +1 more Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 Medium
- wpopal opal estate pro – property management and submission, opal estate pro +1 more Opal Estate Pro – Property Management and Submission <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting 6.4 Medium
- david lingren media library assistant Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang 6.1 Medium
- exclusiveaddons exclusive addons for elementor Exclusive Addons for Elementor <= 2.6.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget 6.4 Medium
- phlex-ruby phlex, ruby fileutils +1 more phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags 7.1 High
- jegtheme jeg elementor kit, jeg kit for elementor – powerful addons for elementor, widgets & templates for wordpress +1 more Jeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial 6.4 Medium
- dfir-iris iris, iris-web +1 more Improper Neutralization of Alternate XSS Syntax in iris-web 4.6 Medium
- codepeople calculated fields form Calculated Fields Form <= 1.2.40 - Authenticated (Admin+) Stored Cross-Site Scripting 4.4 Medium
- dfir-iris iris, iris-web +1 more Improper Neutralization of Alternate XSS Syntax in iris-web 4.6 Medium
- cisco identity services engine software, identity services engine +1 more A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated,... 4.8 Medium
- pimcore customer-data-framework, pimcore/customer-data-framework, customer management framework +2 more Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework 6.5 Medium
- cisco small business smart and managed switches, sf200-24 firmware, sf200-24fp firmware +59 more +61 more A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart... 4.8 Medium
- Show olderLoading…