CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,541)
page 2143 of 2,428| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-65697 | Med | 0.00 | 6.1 | 0.00 | Jul 23, 2026 | Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated… | ||
| CVE-2026-48538 | Med | 0.00 | 5.4 | 0.00 | Jul 23, 2026 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configuration that allows authenticated attackers to inject arbitrary web script or HTML via the configured folders parameter to /Archiver/ImportSettingsWizard.ashx. The… | ||
| CVE-2026-48537 | Med | 0.00 | 5.4 | 0.00 | Jul 23, 2026 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers to inject arbitrary web script or HTML via the excluded extensions parameter to /Archiver/FileArchiveAssistantWizard.aspx… | ||
| CVE-2026-48536 | Med | 0.00 | 5.4 | 0.00 | Jul 23, 2026 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The… | ||
| CVE-2026-48535 | Med | 0.00 | 5.4 | 0.00 | Jul 23, 2026 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx.… | ||
| CVE-2026-48534 | Med | 0.00 | 5.4 | 0.00 | Jul 23, 2026 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is… | ||
| CVE-2026-48532 | Med | 0.00 | 5.4 | 0.00 | Jul 23, 2026 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/FAARetentionPolicyWizard.aspx.… | ||
| CVE-2026-48531 | Med | 0.00 | 5.4 | 0.00 | Jul 23, 2026 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/RetentionPolicyWizard.aspx. The injected… | ||
| CVE-2026-65550 | Med | 0.00 | 5.9 | 0.00 | Jul 23, 2026 | Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions. | ||
| CVE-2026-65538 | Med | 0.00 | 5.9 | 0.00 | Jul 23, 2026 | Author Cross Site Scripting (XSS) in Machete <= 5.2 versions. | ||
| CVE-2026-65534 | Med | 0.00 | 5.9 | 0.00 | Jul 23, 2026 | Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions. | ||
| CVE-2026-65533 | Med | 0.00 | 6.5 | 0.00 | Jul 23, 2026 | Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions. | ||
| CVE-2026-65528 | Med | 0.00 | 6.5 | 0.00 | Jul 23, 2026 | Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions. | ||
| CVE-2026-65527 | Med | 0.00 | 6.5 | 0.00 | Jul 23, 2026 | Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions. | ||
| CVE-2026-65522 | Med | 0.00 | 6.5 | 0.00 | Jul 23, 2026 | Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. | ||
| CVE-2026-65519 | Med | 0.00 | 6.5 | 0.00 | Jul 23, 2026 | Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions. | ||
| CVE-2026-65518 | Med | 0.00 | 6.5 | 0.00 | Jul 23, 2026 | Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions. | ||
| CVE-2026-65514 | Med | 0.00 | 6.5 | 0.00 | Jul 23, 2026 | Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions. | ||
| CVE-2026-65511 | Hig | 0.00 | 7.1 | 0.00 | Jul 23, 2026 | Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. | ||
| CVE-2026-65510 | Hig | 0.00 | 7.1 | 0.00 | Jul 23, 2026 | Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions. |
- risk 0.00cvss 6.1epss 0.00
Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated…
- risk 0.00cvss 5.4epss 0.00
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configuration that allows authenticated attackers to inject arbitrary web script or HTML via the configured folders parameter to /Archiver/ImportSettingsWizard.ashx. The…
- risk 0.00cvss 5.4epss 0.00
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers to inject arbitrary web script or HTML via the excluded extensions parameter to /Archiver/FileArchiveAssistantWizard.aspx…
- risk 0.00cvss 5.4epss 0.00
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The…
- risk 0.00cvss 5.4epss 0.00
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx.…
- risk 0.00cvss 5.4epss 0.00
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is…
- risk 0.00cvss 5.4epss 0.00
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/FAARetentionPolicyWizard.aspx.…
- risk 0.00cvss 5.4epss 0.00
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/RetentionPolicyWizard.aspx. The injected…
- risk 0.00cvss 5.9epss 0.00
Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.
- risk 0.00cvss 5.9epss 0.00
Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.
- risk 0.00cvss 5.9epss 0.00
Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.
- risk 0.00cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.
- risk 0.00cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.
- risk 0.00cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.
- risk 0.00cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
- risk 0.00cvss 6.5epss 0.00
Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.
- risk 0.00cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.
- risk 0.00cvss 6.5epss 0.00
Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.