CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (page 4)
Page 4 of 6 — CVEs classified under CWE-80, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7629 | Medium | 6.4 | 2024-08-21 | The Responsive video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's video settings function in all versions up to, and incl… |
CVE-2024-41697 | Medium | 6.1 | 2024-08-20 | Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) |
CVE-2024-41947 | Critical | 9.0 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rig… |
CVE-2024-41693 | Medium | 6.1 | 2024-07-30 | Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) |
CVE-2024-41810 | Medium | 6.1 | 2024-07-29 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vu… |
CVE-2024-32484 | High | 7.4 | 2024-07-22 | An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to J… |
CVE-2023-35006 | Medium | 5.4 | 2024-07-10 | IBM Security QRadar EDR 3.12 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the v… |
CVE-2024-25639 | Medium | 5.9 | 2024-07-08 | Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user input… |
CVE-2024-27716 | Medium | 5.4 | 2024-07-05 | Cross Site Scripting vulnerability in Eskooly Web Product v.3.0 and before allows a remote attacker to execute arbitrary code via the message sending and user… |
CVE-2024-22277 | Medium | 6.4 | 2024-07-04 | VMware Cloud Director Availability contains an HTML injection vulnerability. A malicious actor with network access to VMware Cloud Director Availability can… |
CVE-2024-6052 | Medium | 6.5 | 2024-07-03 | Stored XSS in Checkmk before versions 2.3.0p8, 2.2.0p29, 2.1.0p45, and 2.0.0 (EOL) allows users to execute arbitrary scripts by injecting HTML elements |
CVE-2024-28832 | Medium | 4.8 | 2024-06-25 | Stored XSS in the Crash Report page in Checkmk before versions 2.3.0p7, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows users with permission to change Global Setti… |
CVE-2024-28831 | Medium | 5.4 | 2024-06-25 | Stored XSS in some confirmation pop-ups in Checkmk before versions 2.3.0p7 and 2.2.0p28 allows Checkmk users to execute arbitrary scripts by injecting HTML ele… |
CVE-2024-37732 | Medium | 6.1 | 2024-06-24 | Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file. |
CVE-2024-6251 | Low | 2.4 | 2024-06-22 | A vulnerability, which was classified as problematic, was found in playSMS 1.4.3. Affected is an unknown function of the file /index.php?app=main&inc=feature_p… |
CVE-2022-38055 | Medium | 4.3 | 2024-06-21 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpForo Forum allows Content Spoofing.This issue af… |
CVE-2024-6183 | Medium | 4.3 | 2024-06-20 | A vulnerability classified as problematic has been found in EZ-Suite EZ-Partner 5. Affected is an unknown function of the component Forgot Password Handler. Th… |
CVE-2024-6108 | Medium | 4.3 | 2024-06-18 | A vulnerability was found in Genexis Tilgin Home Gateway 322_AS0500-03_05_13_05. It has been classified as problematic. Affected is an unknown function of the… |
CVE-2024-38469 | Medium | 6.3 | 2024-06-17 | zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /pay.php. |
CVE-2024-5741 | Medium | 6.5 | 2024-06-17 | Stored XSS in inventory tree rendering in Checkmk before 2.3.0p7, 2.2.0p28, 2.1.0p45 and 2.0.0 (EOL) |
CVE-2024-36395 | Medium | 6.1 | 2024-06-13 | Verint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) |
CVE-2024-37297 | Medium | 5.4 | 2024-06-12 | WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad acto… |
CVE-2024-5851 | Low | 3.5 | 2024-06-11 | A vulnerability classified as problematic has been found in playSMS up to 1.4.7. Affected is an unknown function of the file /index.php?app=main&inc=feature_sc… |
CVE-2024-37166 | High | 8.9 | 2024-06-10 | ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code and trigger a Cross… |
CVE-2024-35680 | Medium | 5.3 | 2024-06-10 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-produ… |
CVE-2024-37156 | Medium | 6.1 | 2024-06-06 | The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input fie… |
CVE-2024-32464 | Medium | 6.1 | 2024-06-04 | Action Text brings rich text content and editing to Rails. Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could po… |
CVE-2023-49852 | Medium | 6.5 | 2024-06-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Vsourz Digital Responsive Slick Slider WordPress allows Code Inj… |
CVE-2023-48285 | Medium | 5.3 | 2024-06-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Tips and Tricks HQ Stripe Payments allows Code Injection.This is… |
CVE-2023-47513 | Medium | 5.4 | 2024-06-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ARI Soft ARI Stream Quiz allows Code Injection.This issue affect… |
CVE-2023-46310 | Medium | 5.3 | 2024-06-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpDiscuz allows Code Injection.This issue affects… |
CVE-2023-45635 | Medium | 5.4 | 2024-06-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Darko Responsive Tabs allows Code Injection.This issue affect… |
CVE-2023-45053 | Medium | 4.3 | 2024-06-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in pluginever WP Content Pilot – Autoblogging & Affiliate Marketing… |
CVE-2023-40557 | Medium | 5.4 | 2024-06-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PickPlugins Tabs & Accordion allows Code Injection.This issue af… |
CVE-2023-39161 | Medium | 5.4 | 2024-06-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Discussion Board Discussion Board allows Content Spoofing, Cr… |
CVE-2023-23735 | Medium | 5.3 | 2024-06-03 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force Spectra allows Code Injection.This issue affect… |
CVE-2024-35224 | High | 7.6 | 2024-05-23 | OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. This dependency, when… |
CVE-2024-4214 | Low | 2.7 | 2024-05-17 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS vulnerability in Bill Minozzi Car Dealer allows Code Injection.This issue affects… |
CVE-2024-32790 | Medium | 4.3 | 2024-05-17 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Supsystic Pricing Table by Supsystic allows Code Injection.This… |
CVE-2024-24874 | Medium | 5.3 | 2024-05-17 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in CodePeople CP Polls allows Code Injection.This issue affects CP… |
CVE-2024-23522 | Medium | 5.3 | 2024-05-17 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Strategy11 Form Builder Team Formidable Forms allows Code Inject… |
CVE-2024-34699 | Medium | 6.5 | 2024-05-14 | GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious te… |
CVE-2024-34070 | Critical | 9.6 | 2024-05-14 | Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting (XSS) vulnerability was identified in the Failed Log… |
CVE-2024-34507 | High | 7.4 | 2024-05-05 | An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. XSS can occu… |
CVE-2024-4439 | High | 7.2 | 2024-05-03 | WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient outp… |
CVE-2024-33423 | High | 7.4 | 2024-05-01 | Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload… |
CVE-2024-32966 | Medium | 5.8 | 2024-05-01 | Static Web Server (SWS) is a tiny and fast production-ready web server suitable to serve static web files or assets. In affected versions if directory listings… |
CVE-2024-33831 | High | 7.4 | 2024-04-30 | A stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows attackers to execute arbitrary web scrip… |
CVE-2023-48763 | Medium | 5.3 | 2024-04-24 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS vulnerability in Crocoblock JetFormBuilder allows Code Injection.This issue affect… |
CVE-2024-32875 | Medium | 6.1 | 2024-04-23 | Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in inte… |
CVE-2024-27306 | Medium | 6.1 | 2024-04-18 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulner… |
CVE-2024-32472 | Medium | 6.1 | 2024-04-17 | excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary Ja… |
CVE-2024-32746 | Medium | 4.6 | 2024-04-17 | A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted… |
CVE-2023-44396 | Medium | 6.8 | 2024-04-15 | iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1. |
CVE-2023-43790 | Medium | 5.7 | 2024-04-15 | iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname va… |
CVE-2024-32489 | Medium | 6.1 | 2024-04-15 | TCPDF before 6.7.4 mishandles calls that use HTML syntax. |
CVE-2024-2380 | Medium | 4.6 | 2024-04-05 | Stored XSS in graph rendering in Checkmk <2.3.0b4. |
CVE-2024-25690 | Medium | 4.7 | 2024-04-04 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker to create a crafte… |
CVE-2024-20362 | Medium | 6.1 | 2024-04-03 | A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an unauthentica… |
CVE-2024-31062 | Medium | 6.3 | 2024-03-28 | Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Street input fie… |
CVE-2024-28108 | Medium | 4.7 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Due to insufficient validation on the `contentLink` para… |
CVE-2024-1606 | Medium | 4.6 | 2024-03-18 | Lack of input sanitization in BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users for manipulation of generated web pages via injection of HTML… |
CVE-2024-28417 | Medium | 6.3 | 2024-03-14 | Webedition CMS 9.2.2.0 has a Stored XSS vulnerability via /webEdition/we_cmd.php. |
CVE-2024-26282 | High | 7.1 | 2024-02-22 | Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. This vulnerability affects Firefox for iO… |
CVE-2024-25873 | Medium | 5.4 | 2024-02-22 | Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module. This vulnerability allows attack… |
CVE-2024-26482 | High | 7.1 | 2024-02-22 | An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because… |
CVE-2024-24812 | Medium | 5.4 | 2024-02-07 | Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to version… |
CVE-2024-24807 | Low | 2.7 | 2024-02-05 | Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name… |
CVE-2024-24574 | Medium | 6.5 | 2024-02-05 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attac… |
CVE-2023-50933 | Medium | 6.1 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the… |
CVE-2024-24571 | Medium | 5.4 | 2024-01-31 | facileManager is a modular suite of web apps built with the sysadmin in mind. For the facileManager web application versions 4.5.0 and earlier, we have found t… |
CVE-2024-23841 | High | 8.2 | 2024-01-30 | apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cros… |
CVE-2023-5933 | Medium | 6.4 | 2024-01-26 | An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sa… |
CVE-2024-23817 | High | 7.1 | 2024-01-25 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML Injection vulnerabilit… |
CVE-2023-20257 | Medium | 4.8 | 2024-01-17 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct cross-site scripti… |
CVE-2024-0183 | Low | 2.4 | 2024-01-01 | A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been classified as problematic. This affects an unknown part of the file /admin… |
CVE-2023-46722 | Medium | 6.1 | 2023-10-31 | The Pimcore Admin Classic Bundle provides a backend UI for Pimcore. Prior to version 1.2.0, a cross-site scripting vulnerability has the potential to steal a u… |
CVE-2023-46235 | Medium | 5.4 | 2023-10-31 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the lo… |
CVE-2023-5582 | Low | 3.5 | 2023-10-14 | A vulnerability, which was classified as problematic, has been found in ZZZCMS 2.2.0. This issue affects some unknown processing of the component Personal Prof… |
CVE-2023-34354 | Low | 3.4 | 2023-10-11 | A stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted H… |
CVE-2023-36555 | Low | 3.9 | 2023-10-10 | An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized c… |
CVE-2023-44393 | Critical | 9.3 | 2023-10-09 | Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?pa… |
CVE-2023-3971 | High | 7.3 | 2023-10-04 | An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login p… |
CVE-2023-20179 | Medium | 4.3 | 2023-09-27 | A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote att… |
CVE-2023-42458 | Low | 3.7 | 2023-09-21 | Zope is an open-source web application server. Prior to versions 4.8.10 and 5.8.5, there is a stored cross site scripting vulnerability for SVG images. Note th… |
CVE-2023-41048 | Low | 3.7 | 2023-09-21 | plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1… |
CVE-2023-4663 | Medium | 6.1 | 2023-09-15 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saphira Saphira Connect allows Reflected XSS. This issue affect… |
CVE-2023-3481 | Medium | 5.7 | 2023-08-21 | Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend upgrading to versi… |
CVE-2023-20222 | Medium | 4.8 | 2023-08-16 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an unauth… |
CVE-2023-20228 | Medium | 6.1 | 2023-08-16 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to conduc… |
CVE-2023-39217 | Medium | 5.3 | 2023-08-08 | Improper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to enable a denial of service via network access. |
CVE-2023-39216 | Critical | 9.6 | 2023-08-08 | Improper input validation in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network a… |
CVE-2023-20218 | Medium | 5.8 | 2023-08-03 | A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to to m… |
CVE-2023-20181 | Medium | 6.1 | 2023-08-03 | A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to conduc… |
CVE-2023-23548 | Medium | 5.4 | 2023-08-01 | Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30. |
CVE-2023-24497 | Medium | 4.7 | 2023-07-06 | Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP reques… |
CVE-2023-24496 | Medium | 4.7 | 2023-07-06 | Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP reques… |
CVE-2023-35157 | High | 8.4 | 2023-06-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request t… |
CVE-2023-35153 | Critical | 9.0 | 2023-06-23 | XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerabili… |
CVE-2023-3017 | Low | 2.4 | 2023-05-31 | A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been classified as problematic. This affects an unknown part of the f… |