CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (page 6)
Page 6 of 6 — CVEs classified under CWE-80, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-37195 | Medium | 6.1 | 2022-01-11 | A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components… |
CVE-2021-43862 | Low | 3.7 | 2021-12-30 | jQuery Terminal Emulator is a plugin for creating command line interpreters in your applications. Versions prior to 2.31.1 contain a low impact and limited cro… |
CVE-2021-39348 | Medium | 5.5 | 2021-10-21 | The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter found in the ~/inc/a… |
CVE-2021-32735 | High | 7.1 | 2021-07-02 | Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's `ListItem` component (used in the pages and files section for example)… |
CVE-2021-28803 | Medium | 5.4 | 2021-07-01 | This issue affects: QNAP Systems Inc. Q'center versions prior to 1.11.1004. |
CVE-2020-36196 | Medium | 6.1 | 2021-07-01 | A stored XSS vulnerability has been reported to affect QNAP NAS running QuLog Center. If exploited, this vulnerability allows attackers to inject malicious cod… |
CVE-2021-32719 | Low | 3.1 | 2021-06-28 | RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI v… |
CVE-2021-32718 | Low | 3.1 | 2021-06-28 | RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's ba… |
CVE-2021-29503 | High | 8.1 | 2021-05-19 | HedgeDoc is a platform to write and share markdown. HedgeDoc before version 1.8.2 is vulnerable to a cross-site scripting attack using the YAML-metadata of a n… |
CVE-2019-25028 | Medium | 5.4 | 2021-04-23 | Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8… |
CVE-2021-29467 | Medium | 6.1 | 2021-04-22 | Wrongthink is an encrypted peer-to-peer chat program. A user could check their fingerprint into the service and enter a script to run arbitrary JavaScript on t… |
CVE-2018-19942 | Medium | 6.1 | 2021-04-16 | A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attacke… |
CVE-2021-29438 | Medium | 4.6 | 2021-04-13 | The Nextcloud dialogs library (npm package @nextcloud/dialogs) before 3.1.2 insufficiently escaped text input passed to a toast. If your application displays t… |
CVE-2021-1420 | Medium | 4.7 | 2021-04-08 | A vulnerability in certain web pages of Cisco Webex Meetings could allow an unauthenticated, remote attacker to modify a web page in the context of a user's br… |
CVE-2019-18944 | Medium | 4.9 | 2021-02-26 | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS. |
CVE-2021-1351 | Medium | 6.1 | 2021-02-17 | A vulnerability in the web-based interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) atta… |
CVE-2020-2502 | Medium | 6.1 | 2021-02-17 | This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the… |
CVE-2020-13564 | Medium | 6.1 | 2021-02-01 | A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript e… |
CVE-2020-13563 | Medium | 6.1 | 2021-02-01 | A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript e… |
CVE-2020-13562 | Medium | 6.1 | 2021-02-01 | A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript e… |
CVE-2020-2503 | Critical | 9.0 | 2020-12-24 | If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QNAP has already fixed thes… |
CVE-2019-19285 | Medium | 5.4 | 2020-12-14 | A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow injections that could lead to XSS attacks if unsuspecting users… |
CVE-2020-2498 | Medium | 6.1 | 2020-12-10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration. QANP have already fix… |
CVE-2020-2497 | Medium | 6.1 | 2020-12-10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs. QANP have already fixed… |
CVE-2020-2496 | Medium | 6.1 | 2020-12-10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vuln… |
CVE-2020-2495 | Medium | 6.1 | 2020-12-10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vuln… |
CVE-2020-2494 | Medium | 6.1 | 2020-12-10 | This cross-site scripting vulnerability in Music Station allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in the fo… |
CVE-2020-2493 | Medium | 6.1 | 2020-12-10 | This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in M… |
CVE-2020-2491 | Medium | 6.1 | 2020-12-10 | This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the… |
CVE-2020-27126 | Medium | 6.1 | 2020-11-18 | A vulnerability in an API of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is… |
CVE-2020-26218 | High | 8.0 | 2020-11-11 | touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting. The vulnerability allows an attacker to inject HTML payloads which could result in defac… |
CVE-2018-19956 | Medium | 6.1 | 2020-11-02 | The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attack… |
CVE-2018-19955 | Medium | 6.1 | 2020-11-02 | The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attack… |
CVE-2018-19954 | Medium | 6.1 | 2020-11-02 | The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attack… |
CVE-2018-19952 | High | 7.5 | 2020-11-02 | If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Systems Inc. Music Stat… |
CVE-2018-19951 | Medium | 6.1 | 2020-11-02 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Music Statio… |
CVE-2018-19953 | Medium | 6.1 | 2020-10-28 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following… |
CVE-2018-19943 | High | 8.0 | 2020-10-28 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the followi… |
CVE-2020-15788 | Medium | 6.1 | 2020-09-09 | A vulnerability has been identified in Polarion Subversion Webclient (All versions). The Polarion subversion web application does not filter user input in a wa… |
CVE-2020-10043 | Medium | 6.1 | 2020-07-14 | A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). The web server could allow C… |
CVE-2020-4049 | Low | 2.4 | 2020-06-12 | In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-a… |
CVE-2020-4047 | Medium | 6.8 | 2020-06-12 | In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pag… |
CVE-2020-4046 | Medium | 5.4 | 2020-06-12 | In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML… |
CVE-2020-13965 | Medium | 6.1 | 2020-06-09 | An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the al… |
CVE-2020-11001 | Medium | 5.8 | 2020-04-14 | In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin int… |
CVE-2020-7575 | Medium | 6.1 | 2020-04-14 | A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions < V11.32). A persistent cr… |
CVE-2020-5283 | Low | 3.1 | 2020-04-03 | ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need f… |
CVE-2020-8966 | Medium | 6.5 | 2020-04-01 | There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware. Tiki-Wiki CMS a… |
CVE-2020-5267 | Medium | 4.0 | 2020-03-19 | In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the… |
CVE-2020-7579 | Medium | 6.1 | 2020-03-10 | A vulnerability has been identified in Spectrum Power™ 5 (All versions < v5.50 HF02). The web server could allow Cross-Site Scripting (XSS) attacks if unsuspec… |
CVE-2019-6585 | Medium | 6.1 | 2020-03-10 | A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All ver… |
CVE-2020-5241 | High | 7.7 | 2020-02-13 | matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4. |
CVE-2019-13931 | Medium | 5.4 | 2019-12-12 | A vulnerability has been identified in XHQ (All versions < V6.0.0.2). The web interface could allow for an an attacker to craft the input in a form that is not… |
CVE-2019-13923 | Critical | 9.6 | 2019-09-13 | A vulnerability has been identified in IE/WSN-PA Link WirelessHART Gateway (All versions). The integrated configuration web server of the affected device could… |
CVE-2019-5450 | Medium | 6.8 | 2019-07-30 | Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in the header bar when… |
CVE-2019-1010018 | Medium | 6.1 | 2019-07-16 | Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The compone… |
CVE-2019-10933 | Medium | 6.1 | 2019-07-11 | A vulnerability has been identified in Spectrum Power 3 (Corporate User Interface) (All versions <= v3.11), Spectrum Power 4 (Corporate User Interface) (Versio… |
CVE-2019-6577 | Medium | 5.4 | 2019-05-14 | A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All ve… |
CVE-2018-16555 | Medium | 5.4 | 2018-12-13 | A vulnerability has been identified in SCALANCE S602 (All versions < V4.0.1.1), SCALANCE S612 (All versions < V4.0.1.1), SCALANCE S623 (All versions < V4.0.1.1… |
CVE-2016-9500 | Medium | 6.1 | 2018-07-13 | Accellion FTP server prior to version FTA_9_12_220 uses the Accusoft Prizm Content flash component, which contains multiple parameters (customTabCategoryName… |
CVE-2016-9493 | Medium | 6.1 | 2018-07-13 | The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to stored cross-site scripting. In the generated form.lib.php file, upload… |
CVE-2018-4848 | Medium | 6.1 | 2018-06-14 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.3), SCALANCE X-200IRT switch family (incl… |
CVE-2017-16043 | Medium | 6.1 | 2018-06-04 | Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's… |
CVE-2017-16015 | Medium | 6.1 | 2018-06-04 | Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize… |
CVE-2014-2353 | | 2014-05-30 | Cross-site scripting (XSS) vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |
CVE-2006-0149 | Medium | 6.1 | 2006-01-09 | Cross-site scripting (XSS) vulnerability in SimpBook 1.0, with html_enable on (the default), allows remote attackers to inject arbitrary web script or HTML via… |