CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,541)
page 2159 of 2,428| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-36162 | Med | 0.00 | 5.4 | 0.00 | Jul 7, 2026 | An authenticated stored cross-site scripting (XSS) vulnerability in the Upload File Shares API of LiquidFiles v4.2.7 allows attackers to execute arbitrary Javascript or HTML via injecting a crafted payload into the Name parameter. | ||
| CVE-2026-55647 | Med | 0.00 | — | 0.00 | Jul 7, 2026 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stored component content with Vue v-html without server-side HTML sanitization, allowing an authenticated user who can edit dashboard component data to inject HTML… | ||
| CVE-2026-55592 | Low | 0.00 | 3.9 | 0.00 | Jul 7, 2026 | Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript… | ||
| CVE-2026-48954 | Med | 0.00 | 6.1 | 0.00 | Jul 7, 2026 | Improper validation leads to a generic XSS vector in the language override feature. | ||
| CVE-2026-48953 | Med | 0.00 | 6.1 | 0.00 | Jul 7, 2026 | Lack of escaping leads to an XSS vulnerability in the generic image output layout. | ||
| CVE-2026-48952 | Med | 0.00 | 6.1 | 0.00 | Jul 7, 2026 | Lack of escaping leads to an XSS vulnerability in the update list view of com_installer. | ||
| CVE-2026-48951 | Med | 0.00 | 6.1 | 0.00 | Jul 7, 2026 | Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components. | ||
| CVE-2026-48950 | Med | 0.00 | 6.1 | 0.00 | Jul 7, 2026 | Lack of escaping leads to an XSS vulnerability in the file management view of com_templates. | ||
| CVE-2026-48949 | Med | 0.00 | 6.1 | 0.00 | Jul 7, 2026 | Lack of validation leads to an XSS vulnerability in the MFA management views. | ||
| CVE-2026-8309 | Med | 0.00 | 5.4 | 0.00 | Jul 7, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows Reflected XSS. This issue affects Access Control System (GKS): before Version 2. | ||
| CVE-2026-8306 | Med | 0.00 | 6.1 | 0.00 | Jul 7, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows Stored XSS. This issue affects Access Control System (GKS): before Version 2. | ||
| CVE-2026-11328 | Med | 0.00 | 6.4 | 0.00 | Jul 7, 2026 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated… | ||
| CVE-2026-53641 | Med | 0.00 | — | 0.00 | Jul 6, 2026 | FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in the client-facing email history views of FOSSBilling. Email HTML content (`content_html`) is rendered into a JavaScript… | ||
| CVE-2026-12154 | Med | 0.00 | 6.4 | 0.00 | Jul 6, 2026 | The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_id' shortcode attribute of the [fbrev] shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output… | ||
| CVE-2026-14791 | Low | 0.00 | 3.5 | 0.00 | Jul 6, 2026 | A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesRequest.php of the component Invoice Note Handler. Executing a manipulation of the argument notes can lead to cross site… | ||
| CVE-2026-14752 | Low | 0.00 | 3.5 | 0.00 | Jul 5, 2026 | A security vulnerability has been detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This affects the function add_definition of the file application/PHP/objects/notes/add_into_dictionary.php. Such manipulation of the argument reference leads to… | ||
| CVE-2026-14704 | Med | 0.00 | 4.3 | 0.00 | Jul 5, 2026 | A vulnerability was found in stephen-kruger bluebox up to 4.5.12. Affected by this vulnerability is an unknown functionality. Performing a manipulation of the argument code results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made… | ||
| CVE-2026-14656 | Med | 0.00 | 4.3 | 0.00 | Jul 4, 2026 | A security vulnerability has been detected in code-projects Assessment Management 1.0. This affects an unknown part of the file /admin/remove-user.php. The manipulation of the argument ID leads to cross site scripting. It is possible to initiate the attack remotely. The exploit… | ||
| CVE-2026-14655 | Low | 0.00 | 2.4 | 0.00 | Jul 4, 2026 | A weakness has been identified in code-projects Assessment Management 1.0. Affected by this issue is some unknown functionality of the file admin/view-users.php. Executing a manipulation of the argument User can lead to cross site scripting. The attack may be performed from… | ||
| CVE-2026-58524 | Med | 0.00 | 5.4 | 0.00 | Jul 3, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
- risk 0.00cvss 5.4epss 0.00
An authenticated stored cross-site scripting (XSS) vulnerability in the Upload File Shares API of LiquidFiles v4.2.7 allows attackers to execute arbitrary Javascript or HTML via injecting a crafted payload into the Name parameter.
- risk 0.00cvss —epss 0.00
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stored component content with Vue v-html without server-side HTML sanitization, allowing an authenticated user who can edit dashboard component data to inject HTML…
- risk 0.00cvss 3.9epss 0.00
Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript…
- risk 0.00cvss 6.1epss 0.00
Improper validation leads to a generic XSS vector in the language override feature.
- risk 0.00cvss 6.1epss 0.00
Lack of escaping leads to an XSS vulnerability in the generic image output layout.
- risk 0.00cvss 6.1epss 0.00
Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.
- risk 0.00cvss 6.1epss 0.00
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.
- risk 0.00cvss 6.1epss 0.00
Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.
- risk 0.00cvss 6.1epss 0.00
Lack of validation leads to an XSS vulnerability in the MFA management views.
- risk 0.00cvss 5.4epss 0.00
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows Reflected XSS. This issue affects Access Control System (GKS): before Version 2.
- risk 0.00cvss 6.1epss 0.00
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows Stored XSS. This issue affects Access Control System (GKS): before Version 2.
- risk 0.00cvss 6.4epss 0.00
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
- risk 0.00cvss —epss 0.00
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in the client-facing email history views of FOSSBilling. Email HTML content (`content_html`) is rendered into a JavaScript…
- risk 0.00cvss 6.4epss 0.00
The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_id' shortcode attribute of the [fbrev] shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output…
- risk 0.00cvss 3.5epss 0.00
A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesRequest.php of the component Invoice Note Handler. Executing a manipulation of the argument notes can lead to cross site…
- risk 0.00cvss 3.5epss 0.00
A security vulnerability has been detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This affects the function add_definition of the file application/PHP/objects/notes/add_into_dictionary.php. Such manipulation of the argument reference leads to…
- risk 0.00cvss 4.3epss 0.00
A vulnerability was found in stephen-kruger bluebox up to 4.5.12. Affected by this vulnerability is an unknown functionality. Performing a manipulation of the argument code results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made…
- risk 0.00cvss 4.3epss 0.00
A security vulnerability has been detected in code-projects Assessment Management 1.0. This affects an unknown part of the file /admin/remove-user.php. The manipulation of the argument ID leads to cross site scripting. It is possible to initiate the attack remotely. The exploit…
- risk 0.00cvss 2.4epss 0.00
A weakness has been identified in code-projects Assessment Management 1.0. Affected by this issue is some unknown functionality of the file admin/view-users.php. Executing a manipulation of the argument User can lead to cross site scripting. The attack may be performed from…
- risk 0.00cvss 5.4epss 0.00
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.