CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (page 3)
Page 3 of 6 — CVEs classified under CWE-80, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4278 | High | 8.7 | 2025-06-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search pag… |
CVE-2025-49137 | High | 8.5 | 2025-06-09 | HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the application does not sufficiently sanitize user in… |
CVE-2025-5686 | Medium | 6.4 | 2025-06-06 | The Paged Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including… |
CVE-2025-23393 | Medium | 5.2 | 2025-05-27 | A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in spacewalk-java allows execution of arbitrary Javascript code… |
CVE-2025-23392 | Medium | 5.2 | 2025-05-26 | A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in spacewalk-java allows execution of arbitrary Javascript code o… |
CVE-2025-33138 | Medium | 5.4 | 2025-05-22 | IBM Aspera Faspex 5.0.0 through 5.0.12 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be execute… |
CVE-2025-20267 | Medium | 4.8 | 2025-05-21 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct cross-si… |
CVE-2024-51475 | Medium | 5.4 | 2025-05-16 | IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would b… |
CVE-2025-4126 | Medium | 6.4 | 2025-05-15 | The EG-Series plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [series] shortcode in all versions up to, and including, 2.1.1… |
CVE-2025-4168 | Medium | 6.4 | 2025-05-03 | The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode in all versions up to, and including… |
CVE-2025-3521 | Medium | 6.4 | 2025-05-01 | The Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2025-39524 | Medium | 6.5 | 2025-04-16 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS… |
CVE-2025-32027 | Medium | 6.1 | 2025-04-10 | Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is… |
CVE-2025-32230 | Medium | 4.3 | 2025-04-10 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Tutor LMS tutor.This issue affects Tutor LMS: from n/a t… |
CVE-2025-31384 | High | 7.1 | 2025-04-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Aviplugins Videos allows Reflected XSS.This issue affects Videos… |
CVE-2025-0272 | Medium | 5.4 | 2025-04-03 | HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially lead… |
CVE-2025-30676 | Medium | 6.1 | 2025-04-01 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.19… |
CVE-2025-30210 | Medium | 6.1 | 2025-04-01 | Bruno is an open source IDE for exploring and testing APIs. Prior to 1.39.1, the custom tool-tip components which internally use react-tooltip were setting the… |
CVE-2025-30161 | Medium | 5.4 | 2025-03-31 | OpenEMR is a free and open source electronic health records and medical practice management application. A stored XSS vulnerability in the Bronchitis form comp… |
CVE-2025-31604 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cal.com Cal.com cal-com allows Stored XSS.This issue affects Cal… |
CVE-2025-31575 | Medium | 5.9 | 2025-03-31 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Vasilis Triantafyllou Flag Icons language-icons-flags-switcher a… |
CVE-2025-22501 | High | 7.1 | 2025-03-28 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Improve My City Improve My City improve-my-city allows Reflected… |
CVE-2025-31075 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in videowhisper MicroPayments paid-membership allows Stored XSS.Thi… |
CVE-2025-1997 | Medium | 5.4 | 2025-03-27 | IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.0 / IBM DevOps Deploy 8.0 through 8.0.1.4 an… |
CVE-2025-29426 | Medium | 4.6 | 2025-03-17 | Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/class.php via the id and cys parameters. |
CVE-2025-29427 | Medium | 5.9 | 2025-03-17 | Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in profile.php via the member_first and member_last para… |
CVE-2025-29430 | Medium | 4.1 | 2025-03-17 | Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/room.php via the id and rome parameters. |
CVE-2025-29431 | Low | 3.2 | 2025-03-17 | Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/department.php via the id, code, and name para… |
CVE-2024-13497 | High | 7.2 | 2025-03-15 | The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attac… |
CVE-2025-25363 | Medium | 6.5 | 2025-03-13 | An authenticated stored cross-site scripting (XSS) vulnerability in The Plugin People Enterprise Mail Handler for Jira Data Center (JEMH) before v4.1.69-dc all… |
CVE-2025-28015 | Medium | 5.3 | 2025-03-13 | A HTML Injection vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management System V3.3. This vuln… |
CVE-2024-34398 | Medium | 4.2 | 2025-03-12 | An issue was discovered in BMC Remedy Mid Tier 7.6.04. The web application allows stored HTML Injection by authenticated remote attackers. |
CVE-2025-27155 | Medium | 6.1 | 2025-03-04 | Pinecone is an experimental overlay routing protocol suite which is the foundation of the current P2P Matrix demos. The Pinecone Simulator (pineconesim) includ… |
CVE-2025-27099 | Medium | 4.8 | 2025-03-03 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the tracker names… |
CVE-2025-1807 | Low | 3.5 | 2025-03-02 | A vulnerability, which was classified as problematic, was found in Eastnets PaymentSafe 2.5.26.0. This affects an unknown part of the file /directRouter.rfc of… |
CVE-2025-22274 | | 2025-02-28 | It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page. This issue affects CyberArk Endpoint… | |
CVE-2025-25299 | | 2025-02-20 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was dis… | |
CVE-2023-51308 | Medium | 6.1 | 2025-02-20 | PHPJabbers Car Park Booking System v3.0 is vulnerable to Multiple HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_a… |
CVE-2024-49337 | Medium | 5.4 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to HTML injection, caused by improper validation of user-supplied input of text fields… |
CVE-2024-13704 | High | 7.2 | 2025-02-18 | The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'st_user_title' parameter in all versions up to, and including… |
CVE-2024-46910 | High | 7.1 | 2025-02-13 | An authenticated user can perform XSS and potentially impersonate another user. This issue affects Apache Atlas versions 2.3.0 and earlier. Users are recomme… |
CVE-2025-22402 | Low | 2.6 | 2025-02-07 | Dell Update Manager Plugin, version(s) 1.5.0 through 1.6.0, contain(s) an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnera… |
CVE-2024-38318 | Medium | 4.8 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be exe… |
CVE-2024-57004 | Medium | 6.1 | 2025-02-03 | Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leadin… |
CVE-2024-11954 | Low | 2.4 | 2025-01-28 | A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Docum… |
CVE-2025-24680 | High | 7.1 | 2025-01-27 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows… |
CVE-2024-35112 | Medium | 5.4 | 2025-01-25 | IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2025-24678 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in listamester Listamester listamester allows Stored XSS.This issue… |
CVE-2025-24673 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AyeCode Ketchup Shortcodes ketchup-shortcodes-pack allows Stored… |
CVE-2025-23919 | Medium | 5.4 | 2025-01-16 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Ella Van Durpe Slides & Presentations slide allows Code Injectio… |
CVE-2024-39363 | Critical | 9.6 | 2025-01-14 | A cross-site scripting (xss) vulnerability exists in the login.cgi set_lang_CountryCode() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craft… |
CVE-2024-52967 | Low | 3.5 | 2025-01-14 | An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiPortal 6.0.0 through 6.0.14 allows attacker to execute unauth… |
CVE-2024-51472 | Low | 3.1 | 2025-01-06 | IBM UrbanCode Deploy (UCD) 7.2 through 7.2.3.13, 7.3 through 7.3.2.8, and IBM DevOps Deploy 8.0 through 8.0.1.3 are vulnerable to HTML injection. This vulnerab… |
CVE-2025-21612 | High | 8.6 | 2025-01-06 | TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when o… |
CVE-2024-56199 | Medium | 5.2 | 2025-01-02 | phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malicious HTML content… |
CVE-2024-41752 | Medium | 5.4 | 2024-12-18 | IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which… |
CVE-2024-12127 | Medium | 6.1 | 2024-12-17 | The Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS plugin for WordPress is vulnerable to Reflected Cross-Site Script… |
CVE-2024-54223 | Medium | 5.3 | 2024-12-09 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in reputeinfosystems ARForms Form Builder arforms-form-builder allo… |
CVE-2023-47869 | Medium | 4.3 | 2024-12-09 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpForo Forum allows Code Injection.This issue affe… |
CVE-2024-54128 | Medium | 5.7 | 2024-12-05 | Directus is a real-time API and App dashboard for managing SQL database content. The Comment feature has implemented a filter to prevent users from adding rest… |
CVE-2024-54001 | Medium | 5.5 | 2024-12-05 | Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fiel… |
CVE-2024-42195 | Low | 3.1 | 2024-12-05 | HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially lead… |
CVE-2024-11479 | | 2024-12-04 | A HTML Injection vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. HTML markup could be added to comment… | |
CVE-2024-52598 | High | 7.5 | 2024-11-20 | 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5… |
CVE-2024-52597 | Medium | 6.1 | 2024-11-20 | 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cros… |
CVE-2024-11404 | Medium | 5.5 | 2024-11-20 | Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Asso… |
CVE-2020-26067 | Medium | 5.4 | 2024-11-18 | A vulnerability in the web-based interface of Cisco Webex Teams could allow an authenticated, remote attacker to conduct cross-site scripting attacks. Th… |
CVE-2024-10592 | Medium | 6.4 | 2024-11-16 | The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup class parameter in all versions up to, and including, 1.6.0… |
CVE-2022-20654 | Medium | 6.1 | 2024-11-15 | A vulnerability in the web-based interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS)… |
CVE-2024-52300 | Critical | 9.0 | 2024-11-13 | macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any… |
CVE-2024-10038 | Medium | 6.1 | 2024-11-13 | The WP-Strava plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.1 due to insuffic… |
CVE-2024-51689 | High | 7.1 | 2024-11-09 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saleswonder Team: Tobias CF7 WOW Styler cf7-styler allows Reflec… |
CVE-2024-10621 | Medium | 6.4 | 2024-11-08 | The Simple Shortcode for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pw_map shortcode in all versions up to… |
CVE-2024-20504 | Medium | 5.4 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Ap… |
CVE-2024-51735 | | 2024-11-05 | Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting (XSS) occurs on the Osmedues web server when viewing results from the workflow, allo… | |
CVE-2024-49377 | Medium | 5.5 | 2024-11-05 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities… |
CVE-2024-9147 | Medium | 6.1 | 2024-11-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Bna Informatics PosPratik allows XSS Through HTTP Query Strings… |
CVE-2024-50344 | Medium | 4.6 | 2024-10-30 | I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIM… |
CVE-2024-9438 | Medium | 6.1 | 2024-10-29 | The SEUR Oficial plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'change_service' parameter in all versions up to, and including… |
CVE-2024-20382 | Medium | 6.1 | 2024-10-23 | A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software co… |
CVE-2024-20341 | Medium | 6.1 | 2024-10-23 | A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software co… |
CVE-2024-20460 | Medium | 6.1 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker… |
CVE-2024-47139 | Medium | 6.8 | 2024-10-16 | A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IQ Configuration utility that allows an attacker with the Administra… |
CVE-2023-32193 | High | 8.3 | 2024-10-16 | A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman's public API endpoint can be exploited. This can lead to an… |
CVE-2023-32192 | High | 8.3 | 2024-10-16 | A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server's public API endpoint can be exploited, allowing an… |
CVE-2024-47815 | Medium | 6.0 | 2024-10-09 | IncidentReporting is a MediaWiki extension for moving incident reports from wikitext to database tables. There are a variety of Cross-site Scripting issues, th… |
CVE-2024-47812 | Medium | 6.0 | 2024-10-09 | ImportDump is an extension for mediawiki designed to automate user import requests. Anyone who can edit the interface strings of a wiki (typically administrato… |
CVE-2024-47782 | High | 7.6 | 2024-10-07 | WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. Special:WikiDiscover is a special page that lists all wikis on t… |
CVE-2024-38039 | Medium | 5.4 | 2024-10-04 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted… |
CVE-2024-47765 | Medium | 6.1 | 2024-10-04 | Minecraft MOTD Parser is a PHP library to parse minecraft server motd. The HtmlGenerator class is subject to potential cross-site scripting (XSS) attack throug… |
CVE-2024-47612 | Low | 3.5 | 2024-10-02 | DataDump is a MediaWiki extension that provides dumps of wikis. Several interface messages are unescaped (more specifically, (datadump-table-column-queued), (d… |
CVE-2024-8981 | High | 7.1 | 2024-10-01 | The Broken Link Checker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg in /app/admin-notices/features/cla… |
CVE-2024-47536 | Medium | 5.4 | 2024-09-30 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their na… |
CVE-2024-8872 | Medium | 6.1 | 2024-09-26 | The Store Hours for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escapi… |
CVE-2024-8680 | Medium | 4.4 | 2024-09-21 | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4… |
CVE-2021-27915 | High | 7.6 | 2024-09-17 | Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic application which could be exploited by a logged in use… |
CVE-2024-2010 | Medium | 6.1 | 2024-09-12 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in TE Informatics V5 allows Reflected XSS. This issue affects V5… |
CVE-2024-45406 | Medium | 5.5 | 2024-09-09 | Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input. |
CVE-2024-38859 | Medium | 6.1 | 2024-08-26 | XSS in the view page with the SLA column configured in Checkmk versions prior to 2.3.0p14, 2.2.0p33, 2.1.0p47 and 2.0.0 (EOL) allowed malicious users to execut… |
CVE-2024-8145 | Low | 2.4 | 2024-08-25 | A vulnerability, which was classified as problematic, has been found in ClassCMS 4.8. Affected by this issue is some unknown functionality of the file /index.p… |