CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (page 4)
Page 4 of 6 — CVEs classified under CWE-80, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-20654 | Medium | 6.1 | 2024-11-15 | A vulnerability in the web-based interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS)… |
CVE-2024-52300 | Critical | 9.0 | 2024-11-13 | macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any… |
CVE-2024-10038 | Medium | 6.1 | 2024-11-13 | The WP-Strava plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.1 due to insuffic… |
CVE-2024-51689 | High | 7.1 | 2024-11-09 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saleswonder Team: Tobias CF7 WOW Styler cf7-styler allows Reflec… |
CVE-2024-10621 | Medium | 6.4 | 2024-11-08 | The Simple Shortcode for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pw_map shortcode in all versions up to… |
CVE-2024-20504 | Medium | 5.4 | 2024-11-06 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Ap… |
CVE-2024-51735 | | 2024-11-05 | Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting (XSS) occurs on the Osmedues web server when viewing results from the workflow, allo… | |
CVE-2024-49377 | Medium | 5.5 | 2024-11-05 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities… |
CVE-2024-9147 | Medium | 6.1 | 2024-11-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Bna Informatics PosPratik allows XSS Through HTTP Query Strings… |
CVE-2024-50344 | Medium | 4.6 | 2024-10-30 | I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIM… |
CVE-2024-9438 | Medium | 6.1 | 2024-10-29 | The SEUR Oficial plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'change_service' parameter in all versions up to, and including… |
CVE-2024-20382 | Medium | 6.1 | 2024-10-23 | A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software co… |
CVE-2024-20341 | Medium | 6.1 | 2024-10-23 | A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software co… |
CVE-2024-20460 | Medium | 6.1 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker… |
CVE-2024-47139 | Medium | 6.8 | 2024-10-16 | A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IQ Configuration utility that allows an attacker with the Administra… |
CVE-2023-32193 | High | 8.3 | 2024-10-16 | A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman's public API endpoint can be exploited. This can lead to an… |
CVE-2023-32192 | High | 8.3 | 2024-10-16 | A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server's public API endpoint can be exploited, allowing an… |
CVE-2024-47815 | Medium | 6.0 | 2024-10-09 | IncidentReporting is a MediaWiki extension for moving incident reports from wikitext to database tables. There are a variety of Cross-site Scripting issues, th… |
CVE-2024-47812 | Medium | 6.0 | 2024-10-09 | ImportDump is an extension for mediawiki designed to automate user import requests. Anyone who can edit the interface strings of a wiki (typically administrato… |
CVE-2024-47782 | High | 7.6 | 2024-10-07 | WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. Special:WikiDiscover is a special page that lists all wikis on t… |
CVE-2024-38039 | Medium | 5.4 | 2024-10-04 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted… |
CVE-2024-47765 | Medium | 6.1 | 2024-10-04 | Minecraft MOTD Parser is a PHP library to parse minecraft server motd. The HtmlGenerator class is subject to potential cross-site scripting (XSS) attack throug… |
CVE-2024-47612 | Low | 3.5 | 2024-10-02 | DataDump is a MediaWiki extension that provides dumps of wikis. Several interface messages are unescaped (more specifically, (datadump-table-column-queued), (d… |
CVE-2024-8981 | High | 7.1 | 2024-10-01 | The Broken Link Checker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg in /app/admin-notices/features/cla… |
CVE-2024-47536 | Medium | 5.4 | 2024-09-30 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their na… |
CVE-2024-8872 | Medium | 6.1 | 2024-09-26 | The Store Hours for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escapi… |
CVE-2024-8680 | Medium | 4.4 | 2024-09-21 | The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4… |
CVE-2021-27915 | High | 7.6 | 2024-09-17 | Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic application which could be exploited by a logged in use… |
CVE-2024-2010 | Medium | 6.1 | 2024-09-12 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in TE Informatics V5 allows Reflected XSS. This issue affects V5… |
CVE-2024-45406 | Medium | 5.5 | 2024-09-09 | Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input. |
CVE-2024-38859 | Medium | 6.1 | 2024-08-26 | XSS in the view page with the SLA column configured in Checkmk versions prior to 2.3.0p14, 2.2.0p33, 2.1.0p47 and 2.0.0 (EOL) allowed malicious users to execut… |
CVE-2024-8145 | Low | 2.4 | 2024-08-25 | A vulnerability, which was classified as problematic, has been found in ClassCMS 4.8. Affected by this issue is some unknown functionality of the file /index.p… |
CVE-2024-7629 | Medium | 6.4 | 2024-08-21 | The Responsive video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's video settings function in all versions up to, and incl… |
CVE-2024-41697 | Medium | 6.1 | 2024-08-20 | Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) |
CVE-2024-41947 | Critical | 9.0 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rig… |
CVE-2024-41693 | Medium | 6.1 | 2024-07-30 | Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) |
CVE-2024-41810 | Medium | 6.1 | 2024-07-29 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vu… |
CVE-2024-32484 | High | 7.4 | 2024-07-22 | An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to J… |
CVE-2023-35006 | Medium | 5.4 | 2024-07-10 | IBM Security QRadar EDR 3.12 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the v… |
CVE-2024-25639 | Medium | 5.9 | 2024-07-08 | Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user input… |
CVE-2024-27716 | Medium | 5.4 | 2024-07-05 | Cross Site Scripting vulnerability in Eskooly Web Product v.3.0 and before allows a remote attacker to execute arbitrary code via the message sending and user… |
CVE-2024-22277 | Medium | 6.4 | 2024-07-04 | VMware Cloud Director Availability contains an HTML injection vulnerability. A malicious actor with network access to VMware Cloud Director Availability can… |
CVE-2024-6052 | Medium | 6.5 | 2024-07-03 | Stored XSS in Checkmk before versions 2.3.0p8, 2.2.0p29, 2.1.0p45, and 2.0.0 (EOL) allows users to execute arbitrary scripts by injecting HTML elements |
CVE-2024-28832 | Medium | 4.8 | 2024-06-25 | Stored XSS in the Crash Report page in Checkmk before versions 2.3.0p7, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows users with permission to change Global Setti… |
CVE-2024-28831 | Medium | 5.4 | 2024-06-25 | Stored XSS in some confirmation pop-ups in Checkmk before versions 2.3.0p7 and 2.2.0p28 allows Checkmk users to execute arbitrary scripts by injecting HTML ele… |
CVE-2024-37732 | Medium | 6.1 | 2024-06-24 | Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file. |
CVE-2024-6251 | Low | 2.4 | 2024-06-22 | A vulnerability, which was classified as problematic, was found in playSMS 1.4.3. Affected is an unknown function of the file /index.php?app=main&inc=feature_p… |
CVE-2022-38055 | Medium | 4.3 | 2024-06-21 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpForo Forum allows Content Spoofing.This issue af… |
CVE-2024-6183 | Medium | 4.3 | 2024-06-20 | A vulnerability classified as problematic has been found in EZ-Suite EZ-Partner 5. Affected is an unknown function of the component Forgot Password Handler. Th… |
CVE-2024-6108 | Medium | 4.3 | 2024-06-18 | A vulnerability was found in Genexis Tilgin Home Gateway 322_AS0500-03_05_13_05. It has been classified as problematic. Affected is an unknown function of the… |
CVE-2024-38469 | Medium | 6.3 | 2024-06-17 | zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /pay.php. |
CVE-2024-5741 | Medium | 6.5 | 2024-06-17 | Stored XSS in inventory tree rendering in Checkmk before 2.3.0p7, 2.2.0p28, 2.1.0p45 and 2.0.0 (EOL) |
CVE-2024-36395 | Medium | 6.1 | 2024-06-13 | Verint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) |
CVE-2024-37297 | Medium | 5.4 | 2024-06-12 | WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad acto… |
CVE-2024-5851 | Low | 3.5 | 2024-06-11 | A vulnerability classified as problematic has been found in playSMS up to 1.4.7. Affected is an unknown function of the file /index.php?app=main&inc=feature_sc… |
CVE-2024-37166 | High | 8.9 | 2024-06-10 | ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code and trigger a Cross… |
CVE-2024-35680 | Medium | 5.3 | 2024-06-10 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-produ… |
CVE-2024-37156 | Medium | 6.1 | 2024-06-06 | The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input fie… |
CVE-2024-32464 | Medium | 6.1 | 2024-06-04 | Action Text brings rich text content and editing to Rails. Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could po… |
CVE-2023-49852 | Medium | 6.5 | 2024-06-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Vsourz Digital Responsive Slick Slider WordPress allows Code Inj… |
CVE-2023-48285 | Medium | 5.3 | 2024-06-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Tips and Tricks HQ Stripe Payments allows Code Injection.This is… |
CVE-2023-47513 | Medium | 5.4 | 2024-06-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ARI Soft ARI Stream Quiz allows Code Injection.This issue affect… |
CVE-2023-46310 | Medium | 5.3 | 2024-06-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpDiscuz allows Code Injection.This issue affects… |
CVE-2023-45635 | Medium | 5.4 | 2024-06-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Darko Responsive Tabs allows Code Injection.This issue affect… |
CVE-2023-45053 | Medium | 4.3 | 2024-06-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in pluginever WP Content Pilot – Autoblogging & Affiliate Marketing… |
CVE-2023-40557 | Medium | 5.4 | 2024-06-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PickPlugins Tabs & Accordion allows Code Injection.This issue af… |
CVE-2023-39161 | Medium | 5.4 | 2024-06-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Discussion Board Discussion Board allows Content Spoofing, Cr… |
CVE-2023-23735 | Medium | 5.3 | 2024-06-03 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force Spectra allows Code Injection.This issue affect… |
CVE-2024-35224 | High | 7.6 | 2024-05-23 | OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. This dependency, when… |
CVE-2024-4214 | Low | 2.7 | 2024-05-17 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS vulnerability in Bill Minozzi Car Dealer allows Code Injection.This issue affects… |
CVE-2024-32790 | Medium | 4.3 | 2024-05-17 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Supsystic Pricing Table by Supsystic allows Code Injection.This… |
CVE-2024-24874 | Medium | 5.3 | 2024-05-17 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in CodePeople CP Polls allows Code Injection.This issue affects CP… |
CVE-2024-23522 | Medium | 5.3 | 2024-05-17 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Strategy11 Form Builder Team Formidable Forms allows Code Inject… |
CVE-2024-34699 | Medium | 6.5 | 2024-05-14 | GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious te… |
CVE-2024-34070 | Critical | 9.6 | 2024-05-14 | Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting (XSS) vulnerability was identified in the Failed Log… |
CVE-2024-34507 | High | 7.4 | 2024-05-05 | An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. XSS can occu… |
CVE-2024-4439 | High | 7.2 | 2024-05-03 | WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient outp… |
CVE-2024-33423 | High | 7.4 | 2024-05-01 | Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload… |
CVE-2024-32966 | Medium | 5.8 | 2024-05-01 | Static Web Server (SWS) is a tiny and fast production-ready web server suitable to serve static web files or assets. In affected versions if directory listings… |
CVE-2024-33831 | High | 7.4 | 2024-04-30 | A stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows attackers to execute arbitrary web scrip… |
CVE-2023-48763 | Medium | 5.3 | 2024-04-24 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS vulnerability in Crocoblock JetFormBuilder allows Code Injection.This issue affect… |
CVE-2024-32875 | Medium | 6.1 | 2024-04-23 | Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in inte… |
CVE-2024-27306 | Medium | 6.1 | 2024-04-18 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulner… |
CVE-2024-32472 | Medium | 6.1 | 2024-04-17 | excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary Ja… |
CVE-2024-32746 | Medium | 4.6 | 2024-04-17 | A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted… |
CVE-2023-44396 | Medium | 6.8 | 2024-04-15 | iTop is an IT service management platform. Dashlet edits ajax endpoints can be used to produce XSS. Fixed in iTop 2.7.10, 3.0.4, and 3.1.1. |
CVE-2023-43790 | Medium | 5.7 | 2024-04-15 | iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname va… |
CVE-2024-32489 | Medium | 6.1 | 2024-04-15 | TCPDF before 6.7.4 mishandles calls that use HTML syntax. |
CVE-2024-2380 | Medium | 4.6 | 2024-04-05 | Stored XSS in graph rendering in Checkmk <2.3.0b4. |
CVE-2024-25690 | Medium | 4.7 | 2024-04-04 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker to create a crafte… |
CVE-2024-20362 | Medium | 6.1 | 2024-04-03 | A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an unauthentica… |
CVE-2024-31062 | Medium | 6.3 | 2024-03-28 | Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Street input fie… |
CVE-2024-28108 | Medium | 4.7 | 2024-03-25 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Due to insufficient validation on the `contentLink` para… |
CVE-2024-1606 | Medium | 4.6 | 2024-03-18 | Lack of input sanitization in BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users for manipulation of generated web pages via injection of HTML… |
CVE-2024-28417 | Medium | 6.3 | 2024-03-14 | Webedition CMS 9.2.2.0 has a Stored XSS vulnerability via /webEdition/we_cmd.php. |
CVE-2024-26282 | High | 7.1 | 2024-02-22 | Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. This vulnerability affects Firefox for iO… |
CVE-2024-25873 | Medium | 5.4 | 2024-02-22 | Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module. This vulnerability allows attack… |
CVE-2024-26482 | High | 7.1 | 2024-02-22 | An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because… |
CVE-2024-24812 | Medium | 5.4 | 2024-02-07 | Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to version… |
CVE-2024-24807 | Low | 2.7 | 2024-02-05 | Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name… |