CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (page 3)
Page 3 of 6 — CVEs classified under CWE-80, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-10128 | Medium | 6.4 | 2025-09-30 | The Eulerpool Research Systems plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aaq' shortcode in all versions up to, and in… |
CVE-2025-60100 | Medium | 5.3 | 2025-09-26 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XS… |
CVE-2025-59573 | Medium | 5.3 | 2025-09-22 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in CozyThemes Cozy Blocks cozy-addons allows Code Injection.This is… |
CVE-2025-57928 | Medium | 5.3 | 2025-09-22 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-pl… |
CVE-2025-10125 | Medium | 6.4 | 2025-09-17 | The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'row' shortcode in all versions up to, and includ… |
CVE-2025-58430 | Medium | 6.1 | 2025-09-09 | listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the sessio… |
CVE-2025-20342 | Medium | 5.4 | 2025-08-27 | A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an authenticated… |
CVE-2025-6247 | Medium | 4.7 | 2025-08-26 | The WordPress Automatic Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.118.0. This is due to m… |
CVE-2025-51989 | High | 7.0 | 2025-08-21 | HTML injection vulnerability in the registration interface in Evolution Consulting Kft. HRmaster module v235 allows an attacker to inject HTML tags into the "k… |
CVE-2025-57730 | Medium | 5.2 | 2025-08-20 | In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature |
CVE-2025-55291 | High | 7.1 | 2025-08-18 | Shaarli is a minimalist bookmark manager and link sharing service. Prior to 0.15.0, the input string in the cloud tag page is not properly sanitized. This allo… |
CVE-2025-54421 | High | 7.2 | 2025-08-18 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Cross-site scripting (XSS) vulnerability in NamelessMC before 2.2.4 allows… |
CVE-2025-54117 | Critical | 9.0 | 2025-08-18 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Cross-site scripting (XSS) vulnerability in NamelessMC before 2.2.3 allows… |
CVE-2025-55672 | Medium | 5.4 | 2025-08-14 | A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can in… |
CVE-2025-54698 | Medium | 5.4 | 2025-08-14 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in RadiusTheme Classified Listing classified-listing allows Code In… |
CVE-2025-8621 | Medium | 6.4 | 2025-08-12 | The Mosaic Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘c’ parameter in all versions up to, and including, 1.0.5 due to… |
CVE-2025-20331 | Medium | 5.4 | 2025-08-06 | A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a stored XSS atta… |
CVE-2025-54789 | Medium | 6.1 | 2025-08-02 | Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that pre… |
CVE-2025-54589 | Medium | 6.3 | 2025-07-31 | Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an inpu… |
CVE-2025-52897 | Medium | 6.5 | 2025-07-30 | GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phis… |
CVE-2025-27514 | Medium | 4.5 | 2025-07-29 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 9.5.0… |
CVE-2024-49343 | Medium | 5.4 | 2025-07-28 | IBM Informix Dynamic Server 12.10 and 14.10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be ex… |
CVE-2025-54414 | | 2025-07-26 | Anubis is a Web AI Firewall Utility that weighs the soul of users' connections using one or more challenges in order to protect upstream resources from scraper… | |
CVE-2025-8029 | High | 8.1 | 2025-07-22 | Thunderbird executed `javascript:` URLs when used in `object` and `embed` tags. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 14… |
CVE-2025-53835 | Critical | 9.0 | 2025-07-14 | XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting… |
CVE-2025-31326 | Medium | 4.1 | 2025-07-08 | SAP�BusinessObjects Business�Intelligence Platform (Web Intelligence) is vulnerable to HTML Injection, allowing an attacker with basic user privileges to injec… |
CVE-2025-27358 | Medium | 4.6 | 2025-07-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows C… |
CVE-2025-2895 | Medium | 5.4 | 2025-06-30 | IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, 2.3.4.1, and 2.3.4.1 iFix1 is vulnerable to HTML injection. A remote attacker coul… |
CVE-2025-53093 | High | 8.6 | 2025-06-27 | TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HT… |
CVE-2023-38007 | Medium | 5.4 | 2025-06-27 | IBM Cloud Pak System 2.3.5.0, 2.3.3.7, 2.3.3.7 iFix1 on Power and 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.4.0, 2.3.4.1 on Intel operating systems is vulnera… |
CVE-2025-52902 | High | 7.6 | 2025-06-26 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown… |
CVE-2025-4367 | Medium | 6.4 | 2025-06-19 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, an… |
CVE-2025-4278 | High | 8.7 | 2025-06-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search pag… |
CVE-2025-49137 | High | 8.5 | 2025-06-09 | HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the application does not sufficiently sanitize user in… |
CVE-2025-5686 | Medium | 6.4 | 2025-06-06 | The Paged Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including… |
CVE-2025-23393 | Medium | 5.2 | 2025-05-27 | A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in spacewalk-java allows execution of arbitrary Javascript code… |
CVE-2025-23392 | Medium | 5.2 | 2025-05-26 | A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in spacewalk-java allows execution of arbitrary Javascript code o… |
CVE-2025-33138 | Medium | 5.4 | 2025-05-22 | IBM Aspera Faspex 5.0.0 through 5.0.12 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be execute… |
CVE-2025-20267 | Medium | 4.8 | 2025-05-21 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct cross-si… |
CVE-2024-51475 | Medium | 5.4 | 2025-05-16 | IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would b… |
CVE-2025-4126 | Medium | 6.4 | 2025-05-15 | The EG-Series plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [series] shortcode in all versions up to, and including, 2.1.1… |
CVE-2025-4168 | Medium | 6.4 | 2025-05-03 | The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode in all versions up to, and including… |
CVE-2025-3521 | Medium | 6.4 | 2025-05-01 | The Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2025-39524 | Medium | 6.5 | 2025-04-16 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS… |
CVE-2025-32027 | Medium | 6.1 | 2025-04-10 | Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is… |
CVE-2025-32230 | Medium | 4.3 | 2025-04-10 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Tutor LMS tutor.This issue affects Tutor LMS: from n/a t… |
CVE-2025-31384 | High | 7.1 | 2025-04-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Aviplugins Videos allows Reflected XSS.This issue affects Videos… |
CVE-2025-0272 | Medium | 5.4 | 2025-04-03 | HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially lead… |
CVE-2025-30676 | Medium | 6.1 | 2025-04-01 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.19… |
CVE-2025-30210 | Medium | 6.1 | 2025-04-01 | Bruno is an open source IDE for exploring and testing APIs. Prior to 1.39.1, the custom tool-tip components which internally use react-tooltip were setting the… |
CVE-2025-30161 | Medium | 5.4 | 2025-03-31 | OpenEMR is a free and open source electronic health records and medical practice management application. A stored XSS vulnerability in the Bronchitis form comp… |
CVE-2025-31604 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cal.com Cal.com cal-com allows Stored XSS.This issue affects Cal… |
CVE-2025-31575 | Medium | 5.9 | 2025-03-31 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Vasilis Triantafyllou Flag Icons language-icons-flags-switcher a… |
CVE-2025-22501 | High | 7.1 | 2025-03-28 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Improve My City Improve My City improve-my-city allows Reflected… |
CVE-2025-31075 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in videowhisper MicroPayments paid-membership allows Stored XSS.Thi… |
CVE-2025-1997 | Medium | 5.4 | 2025-03-27 | IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.0 / IBM DevOps Deploy 8.0 through 8.0.1.4 an… |
CVE-2025-29426 | Medium | 4.6 | 2025-03-17 | Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/class.php via the id and cys parameters. |
CVE-2025-29427 | Medium | 5.9 | 2025-03-17 | Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in profile.php via the member_first and member_last para… |
CVE-2025-29430 | Medium | 4.1 | 2025-03-17 | Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/room.php via the id and rome parameters. |
CVE-2025-29431 | Low | 3.2 | 2025-03-17 | Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/department.php via the id, code, and name para… |
CVE-2024-13497 | High | 7.2 | 2025-03-15 | The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attac… |
CVE-2025-25363 | Medium | 6.5 | 2025-03-13 | An authenticated stored cross-site scripting (XSS) vulnerability in The Plugin People Enterprise Mail Handler for Jira Data Center (JEMH) before v4.1.69-dc all… |
CVE-2025-28015 | Medium | 5.3 | 2025-03-13 | A HTML Injection vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management System V3.3. This vuln… |
CVE-2024-34398 | Medium | 4.2 | 2025-03-12 | An issue was discovered in BMC Remedy Mid Tier 7.6.04. The web application allows stored HTML Injection by authenticated remote attackers. |
CVE-2025-27155 | Medium | 6.1 | 2025-03-04 | Pinecone is an experimental overlay routing protocol suite which is the foundation of the current P2P Matrix demos. The Pinecone Simulator (pineconesim) includ… |
CVE-2025-27099 | Medium | 4.8 | 2025-03-03 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the tracker names… |
CVE-2025-1807 | Low | 3.5 | 2025-03-02 | A vulnerability, which was classified as problematic, was found in Eastnets PaymentSafe 2.5.26.0. This affects an unknown part of the file /directRouter.rfc of… |
CVE-2025-22274 | | 2025-02-28 | It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page. This issue affects CyberArk Endpoint… | |
CVE-2025-25299 | | 2025-02-20 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was dis… | |
CVE-2023-51308 | Medium | 6.1 | 2025-02-20 | PHPJabbers Car Park Booking System v3.0 is vulnerable to Multiple HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_a… |
CVE-2024-49337 | Medium | 5.4 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to HTML injection, caused by improper validation of user-supplied input of text fields… |
CVE-2024-13704 | High | 7.2 | 2025-02-18 | The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'st_user_title' parameter in all versions up to, and including… |
CVE-2024-46910 | High | 7.1 | 2025-02-13 | An authenticated user can perform XSS and potentially impersonate another user. This issue affects Apache Atlas versions 2.3.0 and earlier. Users are recomme… |
CVE-2025-22402 | Low | 2.6 | 2025-02-07 | Dell Update Manager Plugin, version(s) 1.5.0 through 1.6.0, contain(s) an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnera… |
CVE-2024-38318 | Medium | 4.8 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be exe… |
CVE-2024-57004 | Medium | 6.1 | 2025-02-03 | Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leadin… |
CVE-2024-11954 | Low | 2.4 | 2025-01-28 | A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Docum… |
CVE-2025-24680 | High | 7.1 | 2025-01-27 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows… |
CVE-2024-35112 | Medium | 5.4 | 2025-01-25 | IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2025-24678 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in listamester Listamester listamester allows Stored XSS.This issue… |
CVE-2025-24673 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AyeCode Ketchup Shortcodes ketchup-shortcodes-pack allows Stored… |
CVE-2025-23919 | Medium | 5.4 | 2025-01-16 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Ella Van Durpe Slides & Presentations slide allows Code Injectio… |
CVE-2024-39363 | Critical | 9.6 | 2025-01-14 | A cross-site scripting (xss) vulnerability exists in the login.cgi set_lang_CountryCode() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craft… |
CVE-2024-52967 | Low | 3.5 | 2025-01-14 | An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiPortal 6.0.0 through 6.0.14 allows attacker to execute unauth… |
CVE-2024-51472 | Low | 3.1 | 2025-01-06 | IBM UrbanCode Deploy (UCD) 7.2 through 7.2.3.13, 7.3 through 7.3.2.8, and IBM DevOps Deploy 8.0 through 8.0.1.3 are vulnerable to HTML injection. This vulnerab… |
CVE-2025-21612 | High | 8.6 | 2025-01-06 | TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when o… |
CVE-2024-56199 | Medium | 5.2 | 2025-01-02 | phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malicious HTML content… |
CVE-2024-41752 | Medium | 5.4 | 2024-12-18 | IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which… |
CVE-2024-12127 | Medium | 6.1 | 2024-12-17 | The Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS plugin for WordPress is vulnerable to Reflected Cross-Site Script… |
CVE-2024-54223 | Medium | 5.3 | 2024-12-09 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in reputeinfosystems ARForms Form Builder arforms-form-builder allo… |
CVE-2023-47869 | Medium | 4.3 | 2024-12-09 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpForo Forum allows Code Injection.This issue affe… |
CVE-2024-54128 | Medium | 5.7 | 2024-12-05 | Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding rest… |
CVE-2024-54001 | Medium | 5.5 | 2024-12-05 | Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fiel… |
CVE-2024-42195 | Low | 3.1 | 2024-12-05 | HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially lead… |
CVE-2024-11479 | | 2024-12-04 | A HTML Injection vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. HTML markup could be added to comment… | |
CVE-2024-52598 | High | 7.5 | 2024-11-20 | 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5… |
CVE-2024-52597 | Medium | 6.1 | 2024-11-20 | 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cros… |
CVE-2024-11404 | Medium | 5.5 | 2024-11-20 | Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Asso… |
CVE-2020-26067 | Medium | 5.4 | 2024-11-18 | A vulnerability in the web-based interface of Cisco Webex Teams could allow an authenticated, remote attacker to conduct cross-site scripting attacks. Th… |
CVE-2024-10592 | Medium | 6.4 | 2024-11-16 | The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup class parameter in all versions up to, and including, 1.6.0… |