Skip to main content

Over 150 LLM Providers · Over 5,300 Models The most extensible AI-powered pentesting platform. Open source. Star on GitHub

Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)

560
CRITICAL
4,909
HIGH
31,199
MEDIUM
2,399
LOW
39,637 CVEs · Page 247/793
4.8
CVE-2025-55106

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 t

4.8
CVE-2025-55107

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11

4.8
CVE-2025-54543

QuickCMS is vulnerable to Stored XSS via sDescriptionMeta parameter in page editor SEO functionality. Malicious attacker

4.8
CVE-2025-54544

QuickCMS is vulnerable to Stored XSS via aDirFilesDescriptions parameter in files editor functionality. Malicious attack

4.8
CVE-2025-22483

A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If a remo

4.8
CVE-2025-20280

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Pri

4.8
CVE-2025-2694

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 and IBM Sterling File Gateway 6.0.0.0

4.8
CVE-2025-43794

Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported version

4.8
CVE-2025-59715

SMSEagle before 6.11 allows reflected XSS via a username or contact phone number.

4.8
CVE-2025-58114

Improper Input Validation vulnerability in Hallo Welt! GmbH BlueSpice (Extension:CognitiveProcessDesigner) allows Cross-

4.8
CVE-2025-57203

MagicProject AI version 9.1 is affected by a Cross-Site Scripting (XSS) vulnerability within the chatbot generation feat

4.8
CVE-2025-4760

An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper valida

4.8
CVE-2025-48867

Horilla is a free and open source Human Resource Management System (HRMS). A stored cross-site scripting (XSS) vulnerabi

4.8
CVE-2025-57871

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote

4.8
CVE-2025-57873

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote

4.8
CVE-2025-57874

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote

4.8
CVE-2025-57875

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote

4.8
CVE-2025-57876

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote,

4.8
CVE-2025-57877

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote

4.8
CVE-2025-28016

A Reflected Cross-Site Scripting (XSS) vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Re

4.8
CVE-2025-20361

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Uni

4.8
CVE-2025-7329

A Stored Cross-Site Scripting security issue exists in the affected product that could potentially allow a malicious use

4.8
CVE-2025-54266

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a

4.8
CVE-2025-54859

Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaS

4.8
CVE-2025-62248

A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Porta

4.8
CVE-2025-54856

Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored b

4.8
CVE-2025-62499

Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted in

4.8
CVE-2025-9980

QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form). Malicious attacker with admin p

4.8
CVE-2025-9981

QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form). Malicious attacker with adm

4.8
CVE-2023-53689

Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting (XSS) vulnerability in the license key co

4.8
CVE-2023-53690

Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability in the LDAP/AD authentic

4.8
CVE-2023-7312

Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability when adding or configuri

4.8
CVE-2025-20289

Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticat

4.8
CVE-2025-64174

Magento-lts is a long-term support alternative to Magento Community Edition (CE). Versions 20.15.0 and below are affecte

4.8
CVE-2025-54168

A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. If a remote attacker gains an admin

4.8
CVE-2025-12869

The a+HRD developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing remote attackers with administr

4.8
CVE-2025-10018

QuickCMS is vulnerable to multiple Stored XSS in language editor functionality (languages). Malicious attacker with admi

4.8
CVE-2025-55056

Multiple CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

4.8
CVE-2025-55059

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

4.8
CVE-2025-64758

@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis

4.8
CVE-2025-59117

Windu CMS is vulnerable to multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the page editing endpoint windu

4.8
CVE-2025-62731

SOPlanning is vulnerable to Stored XSS in /feries endpoint. Malicious attacker with access to public holidays feature is

4.8
CVE-2025-64049

A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote

4.8
CVE-2025-13505

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Neutralization of

4.8
CVE-2025-6946

A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances vi

4.8
CVE-2025-9638

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Portabilis i-Educa

4.8
CVE-2025-64872

Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability t

4.8
CVE-2025-68275

ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a stored cross-site scripting vulnera

4.8
CVE-2025-68401

ChurchCRM is an open-source church management system. Prior to version 6.0.0, the application stores user-supplied HTML/

4.8
CVE-2023-53906

projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to injec

Frequently Asked Questions

What is CWE-79?

CWE-79 (Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)) is a weakness category in the Common Weakness Enumeration (CWE) system maintained by MITRE. It describes a class of software or hardware vulnerability that can lead to security issues.

How many CVEs are classified as CWE-79?

There are 53,037 CVE records associated with CWE-79 in our database. Of these, 560 are critical severity, 4909 are high severity, and 31199 are medium severity.

How can I protect against CWE-79 vulnerabilities?

Protection strategies depend on the specific weakness type. General measures include input validation, secure coding practices, regular security testing, and keeping software up to date. CyberStrike can help by automatically scanning your infrastructure for vulnerabilities related to CWE-79 using AI-powered security agents.

Detect CWE-79 Vulnerabilities

CyberStrike's AI agents automatically detect improper neutralization of input during web page generation (cross-site scripting) vulnerabilities across your infrastructure.

Get Started