CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1065 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-71447 | Med | 0.38 | — | 0.00 | Aug 6, 2026 | AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: … | ||
| CVE-2026-71446 | Med | 0.38 | — | 0.00 | Aug 6, 2026 | AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a… | ||
| CVE-2026-66706 | Med | 0.38 | 5.9 | 0.00 | Aug 6, 2026 | Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions. | ||
| CVE-2026-28179 | Med | 0.38 | 5.9 | 0.00 | Aug 6, 2026 | Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions. | ||
| CVE-2026-69075 | Med | 0.38 | — | 0.00 | Aug 3, 2026 | FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and… | ||
| CVE-2026-53668 | Med | 0.38 | 6.9 | 0.00 | Jul 27, 2026 | React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS… | ||
| CVE-2026-53667 | Med | 0.38 | 6.9 | 0.00 | Jul 27, 2026 | React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the… | ||
| CVE-2025-68081 | Med | 0.38 | 5.9 | 0.00 | Jul 23, 2026 | Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions. | ||
| CVE-2026-62944 | hig | 0.38 | — | — | Jul 15, 2026 | A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's *alt* attribute via an image attachment with a crafted filename such as `probe." onload="alert(1)`. When any user views the HTML export page… | ||
| CVE-2026-31981 | Med | 0.38 | 5.9 | 0.00 | Jul 9, 2026 | A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restrictive. An authenticated user with administrative privileges can inject malicious HTML tags into N2OS configuration data… | ||
| CVE-2026-55791 | Med | 0.38 | — | 0.00 | Jul 2, 2026 | Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By… | ||
| CVE-2026-56009 | Med | 0.38 | 5.9 | 0.00 | Jun 18, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricksable for Bricks Builder allows Stored XSS. This issue affects Bricksable for Bricks Builder: from n/a through 1.6.83. | ||
| CVE-2026-56007 | Med | 0.38 | 5.9 | 0.00 | Jun 18, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP Ocean Product Sharing allows Stored XSS. This issue affects Ocean Product Sharing: from n/a through 2.2.2. | ||
| CVE-2025-15658 | Med | 0.38 | 5.9 | 0.00 | Jun 15, 2026 | Administrator Cross Site Scripting (XSS) in WP Emmet <= 0.3.4 versions. | ||
| CVE-2026-53568 | Med | 0.38 | — | 0.00 | Jun 12, 2026 | Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, there is a stored XSS vulnerablity in Frappe Report/List View. This issue has been patched in versions 15.107.2 and 16.17.4. | ||
| CVE-2026-47739 | Med | 0.38 | — | 0.00 | Jun 12, 2026 | Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, stored XSS in Note was possible due to lack of sanitization. This issue has been patched in versions 15.106.0 and 16.16.0. | ||
| CVE-2026-44205 | Med | 0.38 | — | 0.00 | Jun 12, 2026 | Frappe is a full-stack web application framework. Prior to version 15.106.0, a stored XSS vulnerability in the user profile image section allows an attacker to execute malicious scripts in the browsers of other users. This issue has been patched in version 15.106.0. | ||
| CVE-2026-53693 | Med | 0.38 | — | 0.00 | Jun 10, 2026 | A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event… | ||
| CVE-2026-28116 | Med | 0.38 | 5.9 | 0.00 | Jun 2, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Emilia Projects Progress Planner allows Stored XSS. This issue affects Progress Planner: from n/a through 1.9.0. | ||
| CVE-2026-44651 | — | Med | 0.38 | — | 0.00 | May 29, 2026 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, when fetch(url) throws, the code sends: res.status(500).send('Error occurred… |
- risk 0.38cvss —epss 0.00
AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: …
- risk 0.38cvss —epss 0.00
AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a…
- risk 0.38cvss 5.9epss 0.00
Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.
- risk 0.38cvss 5.9epss 0.00
Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.
- risk 0.38cvss —epss 0.00
FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and…
- risk 0.38cvss 6.9epss 0.00
React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS…
- risk 0.38cvss 6.9epss 0.00
React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the…
- risk 0.38cvss 5.9epss 0.00
Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions.
- risk 0.38cvss —epss —
A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's *alt* attribute via an image attachment with a crafted filename such as `probe." onload="alert(1)`. When any user views the HTML export page…
- risk 0.38cvss 5.9epss 0.00
A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restrictive. An authenticated user with administrative privileges can inject malicious HTML tags into N2OS configuration data…
- risk 0.38cvss —epss 0.00
Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By…
- risk 0.38cvss 5.9epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricksable for Bricks Builder allows Stored XSS. This issue affects Bricksable for Bricks Builder: from n/a through 1.6.83.
- risk 0.38cvss 5.9epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP Ocean Product Sharing allows Stored XSS. This issue affects Ocean Product Sharing: from n/a through 2.2.2.
- risk 0.38cvss 5.9epss 0.00
Administrator Cross Site Scripting (XSS) in WP Emmet <= 0.3.4 versions.
- risk 0.38cvss —epss 0.00
Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, there is a stored XSS vulnerablity in Frappe Report/List View. This issue has been patched in versions 15.107.2 and 16.17.4.
- risk 0.38cvss —epss 0.00
Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, stored XSS in Note was possible due to lack of sanitization. This issue has been patched in versions 15.106.0 and 16.16.0.
- risk 0.38cvss —epss 0.00
Frappe is a full-stack web application framework. Prior to version 15.106.0, a stored XSS vulnerability in the user profile image section allows an attacker to execute malicious scripts in the browsers of other users. This issue has been patched in version 15.106.0.
- risk 0.38cvss —epss 0.00
A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event…
- risk 0.38cvss 5.9epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Emilia Projects Progress Planner allows Stored XSS. This issue affects Progress Planner: from n/a through 1.9.0.
- risk 0.38cvss —epss 0.00
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, when fetch(url) throws, the code sends: res.status(500).send('Error occurred…