CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (page 6)
Page 6 of 6 — CVEs classified under CWE-80, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-20054 | Low | 3.5 | 2022-06-16 | A vulnerability was found in XYZScripts Contact Form Manager Plugin. It has been rated as problematic. Affected by this issue is some unknown functionality. Th… |
CVE-2017-20044 | Medium | 4.3 | 2022-06-13 | A vulnerability was found in Navetti PricePoint 4.6.0.0. It has been classified as problematic. This affects an unknown part. The manipulation leads to basic c… |
CVE-2017-20043 | Medium | 4.3 | 2022-06-13 | A vulnerability was found in Navetti PricePoint 4.6.0.0 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation l… |
CVE-2018-25039 | Low | 3.5 | 2022-06-12 | A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been declared as problematic. This vulnerability affects unknown code of the file /goform/RgUrlB… |
CVE-2018-25038 | Low | 3.5 | 2022-06-12 | A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been classified as problematic. This affects an unknown part of the file /goform/RgDhcp. The man… |
CVE-2018-25037 | Low | 3.5 | 2022-06-12 | A vulnerability was found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this issue is some unknown functionality of the file /goform/… |
CVE-2018-25036 | Low | 3.5 | 2022-06-12 | A vulnerability has been found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2018-25035 | Low | 3.5 | 2022-06-12 | A vulnerability, which was classified as problematic, was found in Thomson TCW710 ST5D.10.05. Affected is an unknown function of the file /goform/RGFirewallEL… |
CVE-2018-25034 | Low | 3.5 | 2022-06-12 | A vulnerability, which was classified as problematic, has been found in Thomson TCW710 ST5D.10.05. This issue affects some unknown processing of the file /gofo… |
CVE-2017-20036 | Low | 3.5 | 2022-06-10 | A vulnerability, which was classified as problematic, was found in PHPList 3.2.6. Affected is an unknown function of the file /lists/admin/ of the component Bo… |
CVE-2017-20035 | Low | 3.5 | 2022-06-10 | A vulnerability, which was classified as problematic, has been found in PHPList 3.2.6. This issue affects some unknown processing of the file /lists/admin/ of… |
CVE-2017-20034 | Low | 3.5 | 2022-06-10 | A vulnerability classified as problematic was found in PHPList 3.2.6. This vulnerability affects unknown code of the file /lists/admin/ of the component List N… |
CVE-2017-20033 | Medium | 4.3 | 2022-06-10 | A vulnerability classified as problematic has been found in PHPList 3.2.6. This affects an unknown part of the file /lists/admin/. The manipulation of the argu… |
CVE-2017-20027 | Medium | 4.3 | 2022-06-09 | A vulnerability was found in HumHub up to 1.0.1 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to… |
CVE-2017-20026 | Medium | 4.3 | 2022-06-09 | A vulnerability has been found in HumHub up to 1.0.1 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulatio… |
CVE-2019-25070 | Low | 3.5 | 2022-06-09 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in WolfCMS up to 0.8.3.1. It has been rated as problematic. This issue affects some unknown processin… |
CVE-2020-36544 | Low | 3.5 | 2022-06-08 | A vulnerability has been found in SialWeb CMS and classified as problematic. This vulnerability affects unknown code of the component Search Handler. The manip… |
CVE-2022-29258 | High | 7.4 | 2022-05-31 | XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Start… |
CVE-2022-20765 | Medium | 4.8 | 2022-05-27 | A vulnerability in the web applications of Cisco UCS Director could allow an authenticated, remote attacker to conduct a cross-site scripting attack on an affe… |
CVE-2022-29252 | High | 7.4 | 2022-05-25 | XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contains a possibl… |
CVE-2022-29251 | High | 7.4 | 2022-05-25 | XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possi… |
CVE-2022-21238 | Medium | 6.1 | 2022-05-12 | A cross-site scripting (xss) vulnerability exists in the info.jsp functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lea… |
CVE-2022-20740 | Medium | 6.1 | 2022-05-03 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to co… |
CVE-2022-21145 | Medium | 4.8 | 2022-04-14 | A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request… |
CVE-2022-25756 | Medium | 6.1 | 2022-04-12 | A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coa… |
CVE-2022-0989 | High | 7.5 | 2022-04-11 | An unprivileged user could use the functionality of the NS WooCommerce Watermark WordPress plugin through 2.11.3 to load images that hide malware for example f… |
CVE-2022-28648 | Medium | 5.7 | 2022-04-05 | In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered |
CVE-2022-25620 | Low | 3.8 | 2022-03-30 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Group Functionality of Profelis IT Consultancy SambaBox allows A… |
CVE-2008-10001 | Medium | 5.5 | 2022-03-28 | A vulnerability, which was classified as problematic, has been found in Pro2col Stingray FTS. The manipulation of the argument Username leads to cross site scr… |
CVE-2003-5003 | Medium | 5.0 | 2022-03-28 | A vulnerability was found in ISS BlackICE PC Protection. It has been rated as problematic. Affected by this issue is the Update Handler. The manipulation with… |
CVE-2022-1002 | Low | 2.0 | 2022-03-18 | Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with specia… |
CVE-2022-24749 | Medium | 6.1 | 2022-03-14 | Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scrip… |
CVE-2021-37195 | Medium | 6.1 | 2022-01-11 | A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components… |
CVE-2021-43862 | Low | 3.7 | 2021-12-30 | jQuery Terminal Emulator is a plugin for creating command line interpreters in your applications. Versions prior to 2.31.1 contain a low impact and limited cro… |
CVE-2021-39348 | Medium | 5.5 | 2021-10-21 | The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter found in the ~/inc/a… |
CVE-2021-32735 | High | 7.1 | 2021-07-02 | Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's `ListItem` component (used in the pages and files section for example)… |
CVE-2021-28803 | Medium | 5.4 | 2021-07-01 | This issue affects: QNAP Systems Inc. Q'center versions prior to 1.11.1004. |
CVE-2020-36196 | Medium | 6.1 | 2021-07-01 | A stored XSS vulnerability has been reported to affect QNAP NAS running QuLog Center. If exploited, this vulnerability allows attackers to inject malicious cod… |
CVE-2021-32719 | Low | 3.1 | 2021-06-28 | RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI v… |
CVE-2021-32718 | Low | 3.1 | 2021-06-28 | RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's ba… |
CVE-2021-29503 | High | 8.1 | 2021-05-19 | HedgeDoc is a platform to write and share markdown. HedgeDoc before version 1.8.2 is vulnerable to a cross-site scripting attack using the YAML-metadata of a n… |
CVE-2019-25028 | Medium | 5.4 | 2021-04-23 | Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8… |
CVE-2021-29467 | Medium | 6.1 | 2021-04-22 | Wrongthink is an encrypted peer-to-peer chat program. A user could check their fingerprint into the service and enter a script to run arbitrary JavaScript on t… |
CVE-2018-19942 | Medium | 6.1 | 2021-04-16 | A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attacke… |
CVE-2021-29438 | Medium | 4.6 | 2021-04-13 | The Nextcloud dialogs library (npm package @nextcloud/dialogs) before 3.1.2 insufficiently escaped text input passed to a toast. If your application displays t… |
CVE-2021-1420 | Medium | 4.7 | 2021-04-08 | A vulnerability in certain web pages of Cisco Webex Meetings could allow an unauthenticated, remote attacker to modify a web page in the context of a user's br… |
CVE-2019-18944 | Medium | 4.9 | 2021-02-26 | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS. |
CVE-2021-1351 | Medium | 6.1 | 2021-02-17 | A vulnerability in the web-based interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) atta… |
CVE-2020-2502 | Medium | 6.1 | 2021-02-17 | This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the… |
CVE-2020-13564 | Medium | 6.1 | 2021-02-01 | A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript e… |
CVE-2020-13563 | Medium | 6.1 | 2021-02-01 | A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript e… |
CVE-2020-13562 | Medium | 6.1 | 2021-02-01 | A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript e… |
CVE-2020-2503 | Critical | 9.0 | 2020-12-24 | If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QNAP has already fixed thes… |
CVE-2019-19285 | Medium | 5.4 | 2020-12-14 | A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow injections that could lead to XSS attacks if unsuspecting users… |
CVE-2020-2498 | Medium | 6.1 | 2020-12-10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration. QANP have already fix… |
CVE-2020-2497 | Medium | 6.1 | 2020-12-10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs. QANP have already fixed… |
CVE-2020-2496 | Medium | 6.1 | 2020-12-10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vuln… |
CVE-2020-2495 | Medium | 6.1 | 2020-12-10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vuln… |
CVE-2020-2494 | Medium | 6.1 | 2020-12-10 | This cross-site scripting vulnerability in Music Station allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in the fo… |
CVE-2020-2493 | Medium | 6.1 | 2020-12-10 | This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in M… |
CVE-2020-2491 | Medium | 6.1 | 2020-12-10 | This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the… |
CVE-2020-27126 | Medium | 6.1 | 2020-11-18 | A vulnerability in an API of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is… |
CVE-2020-26218 | High | 8.0 | 2020-11-11 | touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting. The vulnerability allows an attacker to inject HTML payloads which could result in defac… |
CVE-2018-19956 | Medium | 6.1 | 2020-11-02 | The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attack… |
CVE-2018-19955 | Medium | 6.1 | 2020-11-02 | The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attack… |
CVE-2018-19954 | Medium | 6.1 | 2020-11-02 | The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attack… |
CVE-2018-19952 | High | 7.5 | 2020-11-02 | If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Systems Inc. Music Stat… |
CVE-2018-19951 | Medium | 6.1 | 2020-11-02 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Music Statio… |
CVE-2018-19953 | Medium | 6.1 | 2020-10-28 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following… |
CVE-2018-19943 | High | 8.0 | 2020-10-28 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the followi… |
CVE-2020-15788 | Medium | 6.1 | 2020-09-09 | A vulnerability has been identified in Polarion Subversion Webclient (All versions). The Polarion subversion web application does not filter user input in a wa… |
CVE-2020-10043 | Medium | 6.1 | 2020-07-14 | A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). The web server could allow C… |
CVE-2020-4049 | Low | 2.4 | 2020-06-12 | In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-a… |
CVE-2020-4047 | Medium | 6.8 | 2020-06-12 | In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pag… |
CVE-2020-4046 | Medium | 5.4 | 2020-06-12 | In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML… |
CVE-2020-13965 | Medium | 6.1 | 2020-06-09 | An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the al… |
CVE-2020-11001 | Medium | 5.8 | 2020-04-14 | In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin int… |
CVE-2020-7575 | Medium | 6.1 | 2020-04-14 | A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions < V11.32). A persistent cr… |
CVE-2020-5283 | Low | 3.1 | 2020-04-03 | ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need f… |
CVE-2020-8966 | Medium | 6.5 | 2020-04-01 | There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware. Tiki-Wiki CMS a… |
CVE-2020-5267 | Medium | 4.0 | 2020-03-19 | In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the… |
CVE-2020-7579 | Medium | 6.1 | 2020-03-10 | A vulnerability has been identified in Spectrum Power™ 5 (All versions < v5.50 HF02). The web server could allow Cross-Site Scripting (XSS) attacks if unsuspec… |
CVE-2019-6585 | Medium | 6.1 | 2020-03-10 | A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All ver… |
CVE-2020-5241 | High | 7.7 | 2020-02-13 | matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4. |
CVE-2019-13931 | Medium | 5.4 | 2019-12-12 | A vulnerability has been identified in XHQ (All versions < V6.0.0.2). The web interface could allow for an an attacker to craft the input in a form that is not… |
CVE-2019-13923 | Critical | 9.6 | 2019-09-13 | A vulnerability has been identified in IE/WSN-PA Link WirelessHART Gateway (All versions). The integrated configuration web server of the affected device could… |
CVE-2019-5450 | Medium | 6.8 | 2019-07-30 | Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in the header bar when… |
CVE-2019-1010018 | Medium | 6.1 | 2019-07-16 | Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The compone… |
CVE-2019-10933 | Medium | 6.1 | 2019-07-11 | A vulnerability has been identified in Spectrum Power 3 (Corporate User Interface) (All versions <= v3.11), Spectrum Power 4 (Corporate User Interface) (Versio… |
CVE-2019-6577 | Medium | 5.4 | 2019-05-14 | A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All ve… |
CVE-2018-16555 | Medium | 5.4 | 2018-12-13 | A vulnerability has been identified in SCALANCE S602 (All versions < V4.0.1.1), SCALANCE S612 (All versions < V4.0.1.1), SCALANCE S623 (All versions < V4.0.1.1… |
CVE-2016-9500 | Medium | 6.1 | 2018-07-13 | Accellion FTP server prior to version FTA_9_12_220 uses the Accusoft Prizm Content flash component, which contains multiple parameters (customTabCategoryName… |
CVE-2016-9493 | Medium | 6.1 | 2018-07-13 | The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to stored cross-site scripting. In the generated form.lib.php file, upload… |
CVE-2018-4848 | Medium | 6.1 | 2018-06-14 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.3), SCALANCE X-200IRT switch family (incl… |
CVE-2017-16043 | Medium | 6.1 | 2018-06-04 | Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's… |
CVE-2017-16015 | Medium | 6.1 | 2018-06-04 | Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize… |
CVE-2014-2353 | | 2014-05-30 | Cross-site scripting (XSS) vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |
CVE-2006-0149 | Medium | 6.1 | 2006-01-09 | Cross-site scripting (XSS) vulnerability in SimpBook 1.0, with html_enable on (the default), allows remote attackers to inject arbitrary web script or HTML via… |