CWE-79 · Cross-site Scripting (page 65)
Page 65 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-47697 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.8.0 are vulnerable to cross-site scripting (XSS) via the Views feature URL handling. Insufficient validation or escaping of user-… |
CVE-2021-47696 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.8.0 are vulnerable to cross-site scripting (XSS) via BPI config ID handling. Insufficient validation or escaping of user-supplied… |
CVE-2021-47695 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.8.0 are vulnerable to stored cross-site scripting (XSS) via the My Tools page. Insufficient validation or escaping of user-suppli… |
CVE-2021-47694 | Medium | 6.1 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.4 / Nagios XI 5.8.6 contains a reflected cross-site scripting (XSS) vulnerability via the… |
CVE-2021-47691 | Medium | 5.4 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.1 / Nagios XI 5.8.2 contains multiple cross-site scripting (XSS) vulnerabilities via the S… |
CVE-2021-47690 | Medium | 5.4 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.1 / Nagios XI 5.8.2 contains multiple cross-site scripting (XSS) vulnerabilities in Overla… |
CVE-2021-47689 | Medium | 5.4 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.0 / Nagios XI 5.8.0 contais a cross-site scripting (XSS) vulnerability in the Templates pa… |
CVE-2020-36866 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.7.3 are vulnerable to cross-site scripting (XSS) via the Manage Users page of the Admin interface. Insufficient validation or esc… |
CVE-2020-36865 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the BPI (Business Process Intelligence) component’s Config Management and Ed… |
CVE-2020-36864 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the background color settings in Dashboards. Insufficient validation or esca… |
CVE-2020-36862 | Medium | 6.1 | 2025-10-30 | Nagios XI versions prior to 5.6.11 contain unauthenticated vulnerabilities in the Highcharts local exporting tool. Crafted export requests could (1) inject scr… |
CVE-2020-36861 | Medium | 5.4 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.8 / Nagios XI 5.7.5 contains multiple cross-site scripting (XSS) vulnerabilities in the ov… |
CVE-2020-36860 | Medium | 5.4 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.7 / Nagios XI 5.7.4 contains multiple cross-site scripting (XSS) vulnerabilities in the ob… |
CVE-2020-36858 | Medium | 5.4 | 2025-10-30 | Nagios Log Server versions prior to 2.1.6 contain cross-site scripting (XSS) vulnerabilities via the web interface on the Create User, Edit User, and Manage Ho… |
CVE-2018-25121 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.4.13 are vulnerable to cross-site scripting (XSS) via the Views page of the web interface. Insufficient validation or escaping of… |
CVE-2018-25119 | Medium | 6.1 | 2025-10-30 | Nagios Fusion versions prior to 4.1.5 are vulnerable to cross-site scripting (XSS) via the "fusionwindow" parameter. Insufficient validation or escaping of use… |
CVE-2017-20209 | Medium | 6.1 | 2025-10-30 | Nagios Fusion versions prior to 4.0.1 are vulnerable to cross-site scripting (XSS) via the Users and Servers pages. Insufficient validation or escaping of user… |
CVE-2016-15053 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the “My Reports” listing of the web interface. Insufficient validation or es… |
CVE-2016-15052 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the Menu System of the web interface. Insufficient validation or escaping of… |
CVE-2016-15051 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the Reports interface through values from the startdate and enddate fields… |
CVE-2016-15049 | Medium | 5.4 | 2025-10-30 | Nagios Log Server versions prior to 1.4.2 are vulnerable to cross-site scripting (XSS) in the Dashboards section when rendering log entries in the Logs table… |
CVE-2013-10074 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2012R2.6 are vulnerable to cross-site scripting (XSS) via the Tools Menu of the web interface. Insufficient validation or escaping… |
CVE-2013-10071 | Medium | 6.1 | 2025-10-30 | Nagios XI versions prior to 2012R1.6 contain a reflected cross-site scripting (XSS) vulnerability in the dashboard dashlet AJAX load functionality. Insufficien… |
CVE-2011-10040 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the link-handling functions used by status and report pages. Insufficient… |
CVE-2011-10039 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the Alert Heatmap report and the “My Reports” listing of the web interfac… |
CVE-2011-10038 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the recurring downtime script of the web interface. Insufficient validati… |
CVE-2011-10037 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the handling of xiwindow variables used to build permalinks in the web in… |
CVE-2011-10036 | Medium | 5.4 | 2025-10-30 | Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the handling of the "backend_url" JavaScript link. Insufficient validatio… |
CVE-2025-62265 | Medium | 5.4 | 2025-10-30 | Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4… |
CVE-2025-52180 | Medium | 6.1 | 2025-10-30 | Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript vi… |
CVE-2025-52179 | Medium | 6.1 | 2025-10-30 | Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Revolution 4.1 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript… |
CVE-2025-64112 | High | 8.0 | 2025-10-30 | Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with… |
CVE-2025-56313 | Medium | 6.1 | 2025-10-30 | A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the /publix/run endpoint of JATOS 3.7.1 through 3.9.6 (inclusive). This allows remote at… |
CVE-2025-63885 | Medium | 6.1 | 2025-10-30 | A stored cross-site scripting (XSS) vulnerability in AIxBlock commit 04f305 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted p… |
CVE-2025-60950 | Medium | 6.1 | 2025-10-30 | An arbitrary file upload vulnerability in the Data Preparation function of AIxBlock commit f60975 allows attackers to execute arbitrary code via a crafted SVG… |
CVE-2025-36592 | Medium | 5.4 | 2025-10-30 | Dell Secure Connect Gateway (SCG) Policy Manager, version(s) 5.20. 5.22, 5.24, 5.26, 5.28, contain(s) an Improper Neutralization of Input During Web Page Gener… |
CVE-2025-5347 | Medium | 6.3 | 2025-10-30 | Zohocorp ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to Stored Cross Site Scripting in the reports module. |
CVE-2025-5343 | Medium | 6.3 | 2025-10-30 | Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 are vulnerable to Stored Cross Site Scripting in the Instant Search option. |
CVE-2025-50574 | Medium | 6.1 | 2025-10-30 | Cross-site scripting (XSS) vulnerability in blog-details.php in Hiruna Gallage's Glamour Salon Management System v1 allows remote attackers to inject arbitrary… |
CVE-2025-10348 | | 2025-10-30 | URVE Smart Office is vulnerable to Stored XSS in report problem functionality. An attacker with a low-privileged account can upload an SVG file containing a ma… | |
CVE-2025-39663 | High | 8.4 | 2025-10-30 | Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised remote site to inject malicious HTML code into service output… |
CVE-2025-12475 | Medium | 6.4 | 2025-10-30 | The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blocksy_newsletter_subscribe' shortcode in all versio… |
CVE-2025-12083 | Medium | 6.1 | 2025-10-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripti… |
CVE-2025-10931 | Low | 3.8 | 2025-10-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS)… |
CVE-2025-10927 | Medium | 6.1 | 2025-10-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XS… |
CVE-2025-10926 | Medium | 6.1 | 2025-10-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field allows Cross-Site Scripting (XSS).This… |
CVE-2025-54384 | Medium | 6.3 | 2025-10-29 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, the helpers.markdown_extract() functio… |
CVE-2025-12450 | Medium | 6.1 | 2025-10-29 | The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 7.5.0.1 due to insuffic… |
CVE-2025-64291 | Medium | 5.9 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allow… |
CVE-2025-64289 | Medium | 5.9 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premmerce Premmerce Product Search for WooCommerce premme… |
CVE-2025-64220 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReyCommerce Rey Core rey-core allows Stored XSS.This issu… |
CVE-2025-64208 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah - Extensions jannah-extensions allows DOM-… |
CVE-2025-64204 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeSphere SmartMag smart-mag allows Stored XSS.This iss… |
CVE-2025-64202 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Sahifa sahifa allows DOM-Based XSS.This issue aff… |
CVE-2025-64200 | Medium | 5.9 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce emai… |
CVE-2025-64197 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam Rehub rehub-theme allows Stored XSS.This issue affe… |
CVE-2025-64194 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Eduma eduma allows Stored XSS.This issue affect… |
CVE-2025-49042 | Medium | 5.9 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This… |
CVE-2025-64094 | Medium | 6.4 | 2025-10-28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, sanitization of the content of… |
CVE-2025-62800 | Medium | 6.1 | 2025-10-28 | FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth clie… |
CVE-2025-62798 | Medium | 5.4 | 2025-10-28 | Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting (XSS) vulnerability was discovered in code16/sh… |
CVE-2025-62796 | Medium | 5.8 | 2025-10-28 | PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Versions 1.7.7 through 2.0.1 allow persistent HTML injection via the unsan… |
CVE-2025-59837 | High | 7.2 | 2025-10-28 | Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using… |
CVE-2025-61080 | Medium | 5.4 | 2025-10-28 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Clear2Pay Bank Visibility Application - Payment Execution 1.10.0.104 via the ID par… |
CVE-2025-34318 | | 2025-10-28 | IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbit… | |
CVE-2025-34317 | Medium | 5.4 | 2025-10-28 | IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbit… |
CVE-2025-34316 | Medium | 5.4 | 2025-10-28 | IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbit… |
CVE-2025-34315 | Medium | 5.4 | 2025-10-28 | IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbit… |
CVE-2025-34314 | Medium | 5.4 | 2025-10-28 | IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbit… |
CVE-2025-34313 | Medium | 5.4 | 2025-10-28 | IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbit… |
CVE-2025-34310 | Medium | 5.4 | 2025-10-28 | IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbit… |
CVE-2025-34309 | Medium | 5.4 | 2025-10-28 | IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbit… |
CVE-2025-34308 | Medium | 5.4 | 2025-10-28 | IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbit… |
CVE-2025-34307 | Medium | 5.4 | 2025-10-28 | IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbit… |
CVE-2025-34306 | Medium | 5.4 | 2025-10-28 | IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbit… |
CVE-2025-34305 | Medium | 5.4 | 2025-10-28 | IPFire versions prior to 2.29 (Core Update 198) contain multiple stored cross-site scripting (XSS) vulnerabilities caused by a bug in the cleanhtml() function… |
CVE-2025-34303 | Medium | 5.4 | 2025-10-28 | IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbit… |
CVE-2025-34302 | Medium | 5.4 | 2025-10-28 | IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbit… |
CVE-2025-34301 | Medium | 5.4 | 2025-10-28 | IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbit… |
CVE-2025-12335 | Medium | 4.3 | 2025-10-28 | A vulnerability was determined in code-projects E-Commerce Website 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/supplier_… |
CVE-2025-12332 | Low | 2.4 | 2025-10-28 | A flaw has been found in SourceCodester Student Grades Management System 1.0. This affects the function delete_user of the file /admin.php. Executing manipulat… |
CVE-2025-12334 | Medium | 4.3 | 2025-10-27 | A vulnerability was found in code-projects E-Commerce Website 1.0. Affected is an unknown function of the file /pages/product_add.php. The manipulation of the… |
CVE-2025-12333 | Medium | 4.3 | 2025-10-27 | A vulnerability has been found in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/supplier_add.php. The manipulation… |
CVE-2025-62793 | Medium | 6.8 | 2025-10-27 | eLabFTW is an open source electronic lab notebook for research labs. The application served uploaded SVG files inline. Because SVG supports active content, an… |
CVE-2025-62779 | Medium | 5.4 | 2025-10-27 | Frappe Learning is a learning system that helps users structure their content. In Frappe Learning 2.39.1 and earlier, users were able to add HTML through input… |
CVE-2025-12330 | Low | 2.4 | 2025-10-27 | A security flaw has been discovered in Willow CMS up to 1.4.0. This issue affects some unknown processing of the file /admin/articles/add of the component Add… |
CVE-2025-62263 | Medium | 5.4 | 2025-10-27 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through upda… |
CVE-2025-12312 | Low | 2.4 | 2025-10-27 | A flaw has been found in PHPGurukul Curfew e-Pass Management System 1.0. Impacted is an unknown function of the file view-pass-detail.php. This manipulation of… |
CVE-2025-12311 | Low | 2.4 | 2025-10-27 | A vulnerability was detected in PHPGurukul Curfew e-Pass Management System 1.0. This issue affects some unknown processing of the file edit-category-detail.php… |
CVE-2025-53533 | Medium | 6.1 | 2025-10-27 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interfa… |
CVE-2025-36170 | Medium | 6.4 | 2025-10-27 | IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated us… |
CVE-2025-36138 | Medium | 6.4 | 2025-10-27 | IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated us… |
CVE-2025-32785 | Medium | 5.4 | 2025-10-27 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interfa… |
CVE-2025-60983 | Medium | 5.4 | 2025-10-27 | Reflected Cross Site Scripting vulnerability in Rubikon Banking Solution 4.0.3 in the "Search For Customers Information" endpoints. |
CVE-2025-54965 | Medium | 6.1 | 2025-10-27 | An XSS issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not properly sanitize the job ID parameter before using it i… |
CVE-2025-12303 | Low | 2.4 | 2025-10-27 | A flaw has been found in PHPGurukul Curfew e-Pass Management System 1.0. The impacted element is an unknown function of the file admin-profile.php. Executing a… |
CVE-2025-12302 | Medium | 4.3 | 2025-10-27 | A vulnerability was detected in code-projects Simple Food Ordering System 1.0. The affected element is an unknown function of the file /editproduct.php. Perfor… |
CVE-2025-12300 | Medium | 4.3 | 2025-10-27 | A weakness has been identified in code-projects Simple Food Ordering System 1.0. This issue affects some unknown processing of the file /addcategory.php. This… |
CVE-2025-54967 | Medium | 6.5 | 2025-10-27 | An issue was discovered in BAE SOCET GXP before 4.6.0.3. It permits external entities in certain XML-based files. An attacker who is able to social engineer a… |
CVE-2025-12299 | Medium | 4.3 | 2025-10-27 | A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This vulnerability affects unknown code of the file /addproduct.php. The… |