CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (page 5)
Page 5 of 6 — CVEs classified under CWE-80, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-24574 | Medium | 6.5 | 2024-02-05 | phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attac… |
CVE-2023-50933 | Medium | 6.1 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the… |
CVE-2024-24571 | Medium | 5.4 | 2024-01-31 | facileManager is a modular suite of web apps built with the sysadmin in mind. For the facileManager web application versions 4.5.0 and earlier, we have found t… |
CVE-2024-23841 | High | 8.2 | 2024-01-30 | apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cros… |
CVE-2023-5933 | Medium | 6.4 | 2024-01-26 | An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sa… |
CVE-2024-23817 | High | 7.1 | 2024-01-25 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML Injection vulnerabilit… |
CVE-2023-20257 | Medium | 4.8 | 2024-01-17 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct cross-site scripti… |
CVE-2024-0183 | Low | 2.4 | 2024-01-01 | A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been classified as problematic. This affects an unknown part of the file /admin… |
CVE-2023-46722 | Medium | 6.1 | 2023-10-31 | The Pimcore Admin Classic Bundle provides a backend UI for Pimcore. Prior to version 1.2.0, a cross-site scripting vulnerability has the potential to steal a u… |
CVE-2023-46235 | Medium | 5.4 | 2023-10-31 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the lo… |
CVE-2023-5582 | Low | 3.5 | 2023-10-14 | A vulnerability, which was classified as problematic, has been found in ZZZCMS 2.2.0. This issue affects some unknown processing of the component Personal Prof… |
CVE-2023-34354 | Low | 3.4 | 2023-10-11 | A stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted H… |
CVE-2023-36555 | Low | 3.9 | 2023-10-10 | An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized c… |
CVE-2023-44393 | Critical | 9.3 | 2023-10-09 | Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?pa… |
CVE-2023-3971 | High | 7.3 | 2023-10-04 | An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login p… |
CVE-2023-20179 | Medium | 4.3 | 2023-09-27 | A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote att… |
CVE-2023-42458 | Low | 3.7 | 2023-09-21 | Zope is an open-source web application server. Prior to versions 4.8.10 and 5.8.5, there is a stored cross site scripting vulnerability for SVG images. Note th… |
CVE-2023-41048 | Low | 3.7 | 2023-09-21 | plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1… |
CVE-2023-4663 | Medium | 6.1 | 2023-09-15 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saphira Saphira Connect allows Reflected XSS. This issue affect… |
CVE-2023-3481 | Medium | 5.7 | 2023-08-21 | Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend upgrading to versi… |
CVE-2023-20222 | Medium | 4.8 | 2023-08-16 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an unauth… |
CVE-2023-20228 | Medium | 6.1 | 2023-08-16 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to conduc… |
CVE-2023-39217 | Medium | 5.3 | 2023-08-08 | Improper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to enable a denial of service via network access. |
CVE-2023-39216 | Critical | 9.6 | 2023-08-08 | Improper input validation in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network a… |
CVE-2023-20218 | Medium | 5.8 | 2023-08-03 | A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to to m… |
CVE-2023-20181 | Medium | 6.1 | 2023-08-03 | A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to conduc… |
CVE-2023-23548 | Medium | 5.4 | 2023-08-01 | Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30. |
CVE-2023-24497 | Medium | 4.7 | 2023-07-06 | Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP reques… |
CVE-2023-24496 | Medium | 4.7 | 2023-07-06 | Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP reques… |
CVE-2023-35157 | High | 8.4 | 2023-06-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request t… |
CVE-2023-35153 | Critical | 9.0 | 2023-06-23 | XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerabili… |
CVE-2023-3017 | Low | 2.4 | 2023-05-31 | A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been classified as problematic. This affects an unknown part of the f… |
CVE-2023-2981 | Low | 3.5 | 2023-05-30 | A vulnerability, which was classified as problematic, has been found in Abstrium Pydio Cells 4.2.0. This issue affects some unknown processing of the component… |
CVE-2023-33196 | Medium | 5.5 | 2023-05-26 | Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4… |
CVE-2023-33194 | Low | 3.7 | 2023-05-26 | Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message… |
CVE-2023-33197 | Medium | 5.5 | 2023-05-26 | Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue h… |
CVE-2023-30615 | Medium | 6.3 | 2023-05-25 | Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vu… |
CVE-2023-0007 | Medium | 6.5 | 2023-05-10 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to st… |
CVE-2023-25833 | Medium | 5.4 | 2023-05-10 | There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted… |
CVE-2023-1384 | Medium | 4.3 | 2023-05-03 | The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue a… |
CVE-2023-22309 | Medium | 6.1 | 2023-04-20 | Reflective Cross-Site-Scripting in Webconf in Tribe29 Checkmk Appliance before 1.6.4. |
CVE-2023-29508 | High | 8.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. A user without script rights can introduce a stored XSS by using the Li… |
CVE-2022-35850 | Medium | 4.3 | 2023-04-11 | An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6… |
CVE-2023-29112 | Low | 3.7 | 2023-04-11 | The SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a… |
CVE-2023-29110 | Low | 3.7 | 2023-04-11 | The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows… |
CVE-2023-28851 | Medium | 6.1 | 2023-04-03 | Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 and prior to versi… |
CVE-2023-1013 | Medium | 6.1 | 2023-03-30 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Virames Vira-Investing allows Cross-Site Scripting (XSS). This… |
CVE-2022-1274 | Medium | 5.4 | 2023-03-29 | A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can… |
CVE-2021-44197 | Medium | 6.1 | 2023-03-07 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in UBIT Information Technologies Student Information Management Sys… |
CVE-2021-44196 | Medium | 6.1 | 2023-03-07 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in UBIT Information Technologies Student Information Management Sys… |
CVE-2023-26047 | Medium | 6.5 | 2023-03-03 | teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerabl… |
CVE-2023-26046 | Medium | 6.5 | 2023-03-02 | teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version 0.1.1 is vulnerable… |
CVE-2023-22464 | Medium | 5.4 | 2023-01-04 | ViewVC is a browser interface for CVS and Subversion version control repositories. Versions prior to 1.2.3 and 1.1.30 are vulnerable to cross-site scripting. T… |
CVE-2023-22461 | High | 7.6 | 2023-01-04 | The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing s… |
CVE-2022-38210 | Medium | 6.1 | 2022-12-29 | There is a reflected HTML injection vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below that may allow a remote, unauthenticated attacker to crea… |
CVE-2022-23543 | Medium | 6.3 | 2022-12-19 | Silverware Games is a social network where people can play games online. Users can attach URLs to YouTube videos, the site will generate related `<iframe>` whe… |
CVE-2022-28703 | Medium | 5.4 | 2022-12-15 | A stored cross-site scripting vulnerability exists in the HdConfigActions.aspx altertextlanguages functionality of Lansweeper lansweeper 10.1.1.0. A specially-… |
CVE-2022-46350 | Medium | 6.1 | 2022-12-13 | A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HS… |
CVE-2022-39372 | Low | 3.5 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39371 | High | 7.5 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39277 | Medium | 4.5 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-3844 | Low | 3.5 | 2022-11-02 | A vulnerability, which was classified as problematic, was found in Webmin 2.001. Affected is an unknown function of the file xterm/index.cgi. The manipulation… |
CVE-2022-39348 | Medium | 5.4 | 2022-10-26 | Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.v… |
CVE-2022-39301 | High | 8.2 | 2022-10-19 | sra-admin is a background rights management system that separates the front and back end. sra-admin version 1.1.1 has a storage cross-site scripting (XSS) vuln… |
CVE-2022-39240 | Medium | 5.4 | 2022-09-24 | MyGraph is a permission management system. Versions prior to 1.0.4 are vulnerable to a storage XSS vulnerability leading to Remote Code Execution. This issue i… |
CVE-2022-36097 | High | 8.9 | 2022-09-08 | XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-r… |
CVE-2022-36096 | High | 8.9 | 2022-09-08 | The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior… |
CVE-2022-36094 | High | 8.9 | 2022-09-08 | XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 a… |
CVE-2022-36057 | Medium | 5.4 | 2022-09-06 | Discourse-Chat is an asynchronous messaging plugin for the Discourse open-source discussion platform. Users of Discourse Chat can be affected by admin users in… |
CVE-2022-35278 | Medium | 6.1 | 2022-08-23 | In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML… |
CVE-2022-35509 | Medium | 5.4 | 2022-08-10 | An issue was discovered in EyouCMS 1.5.8. There is a Storage XSS vulnerability that can allows an attacker to execute arbitrary Web scripts or HTML by injectin… |
CVE-2022-36325 | Medium | 6.8 | 2022-08-10 | Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with a… |
CVE-2022-1293 | Medium | 5.7 | 2022-08-02 | The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions. |
CVE-2017-20140 | Medium | 4.3 | 2022-07-22 | A vulnerability was found in Itech Movie Portal Script 7.36. It has been rated as problematic. Affected by this issue is some unknown functionality of the file… |
CVE-2022-20916 | Medium | 6.1 | 2022-07-22 | A vulnerability in the web-based management interface of Cisco IoT Control Center could allow an unauthenticated, remote attacker to conduct a cross-site scrip… |
CVE-2017-20122 | Low | 3.5 | 2022-06-30 | A vulnerability classified as problematic was found in Bitrix Site Manager 12.06.2015. Affected by this vulnerability is an unknown functionality of the compon… |
CVE-2017-20118 | Low | 3.5 | 2022-06-29 | A vulnerability was found in TrueConf Server 4.3.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/c… |
CVE-2017-20117 | Low | 3.5 | 2022-06-29 | A vulnerability was found in TrueConf Server 4.3.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2017-20116 | Low | 3.5 | 2022-06-29 | A vulnerability was found in TrueConf Server 4.3.7. It has been classified as problematic. Affected is an unknown function of the file /admin/group/list/. The… |
CVE-2017-20115 | Low | 3.5 | 2022-06-29 | A vulnerability was found in TrueConf Server 4.3.7 and classified as problematic. This issue affects some unknown processing of the file /admin/conferences/lis… |
CVE-2017-20114 | Low | 3.5 | 2022-06-29 | A vulnerability has been found in TrueConf Server 4.3.7 and classified as problematic. This vulnerability affects unknown code of the file /admin/conferences/g… |
CVE-2017-20113 | Low | 3.5 | 2022-06-29 | A vulnerability, which was classified as problematic, was found in TrueConf Server 4.3.7. This affects an unknown part. The manipulation leads to basic cross s… |
CVE-2017-20108 | Low | 3.5 | 2022-06-29 | A vulnerability classified as problematic has been found in Easy Table Plugin 1.6. This affects an unknown part of the file /wordpress/wp-admin/options-general… |
CVE-2017-20098 | Low | 3.5 | 2022-06-27 | A vulnerability was found in Admin Custom Login Plugin 2.4.5.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads… |
CVE-2017-20100 | Low | 3.5 | 2022-06-27 | A vulnerability was found in Air Transfer 1.0.14/1.2.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulatio… |
CVE-2022-29168 | Critical | 9.6 | 2022-06-25 | Wire is a secure messaging application. Wire is vulnerable to arbitrary HTML and Javascript execution via insufficient escaping when rendering `@mentions` in t… |
CVE-2017-20097 | Low | 3.5 | 2022-06-24 | A vulnerability was found in WP-Filebase Download Manager Plugin 3.4.4. It has been rated as problematic. Affected by this issue is some unknown functionality… |
CVE-2017-20096 | Low | 3.5 | 2022-06-24 | A vulnerability classified as problematic has been found in WP-SpamFree Anti-Spam Plugin 2.1.1.4. This affects an unknown part. The manipulation leads to basic… |
CVE-2017-20094 | Low | 3.5 | 2022-06-24 | A vulnerability, which was classified as problematic, has been found in NewStatPress Plugin 1.2.4. This issue affects some unknown processing. The manipulation… |
CVE-2017-20092 | Low | 3.5 | 2022-06-24 | A vulnerability classified as problematic was found in Google Analytics Dashboard Plugin 2.1.1. Affected by this vulnerability is an unknown functionality. The… |
CVE-2017-20089 | Low | 3.5 | 2022-06-23 | A vulnerability was found in Gwolle Guestbook Plugin 1.7.4. It has been rated as problematic. This issue affects some unknown processing. The manipulation lead… |
CVE-2017-20087 | Low | 3.5 | 2022-06-23 | A vulnerability, which was classified as problematic, has been found in Alpine PhotoTile for Instagram Plugin 1.2.7.7. Affected by this issue is some unknown f… |
CVE-2017-20085 | Low | 3.5 | 2022-06-23 | A vulnerability has been found in Atahualpa Theme and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation l… |
CVE-2017-20061 | Medium | 4.3 | 2022-06-20 | A vulnerability has been found in Elefant CMS 1.3.12-RC and classified as problematic. This vulnerability affects unknown code of the file /admin/extended. The… |
CVE-2017-20060 | Low | 3.5 | 2022-06-20 | A vulnerability, which was classified as problematic, was found in Elefant CMS 1.3.12-RC. This affects an unknown part of the component Blog Post Handler. The… |
CVE-2017-20059 | Low | 3.5 | 2022-06-20 | A vulnerability, which was classified as problematic, has been found in Elefant CMS 1.3.12-RC. Affected by this issue is some unknown functionality of the comp… |
CVE-2017-20058 | Medium | 4.3 | 2022-06-20 | A vulnerability classified as problematic was found in Elefant CMS 1.3.12-RC. Affected by this vulnerability is an unknown functionality of the component Versi… |
CVE-2017-20057 | Medium | 4.3 | 2022-06-20 | A vulnerability classified as problematic has been found in Elefant CMS 1.3.12-RC. Affected is an unknown function. The manipulation of the argument username l… |
CVE-2017-20056 | Low | 3.5 | 2022-06-16 | A vulnerability was found in weblizar User Login Log Plugin 2.2.1. It has been classified as problematic. Affected is an unknown function. The manipulation lea… |
CVE-2017-20055 | Low | 3.5 | 2022-06-16 | A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basi… |