CWE-79

HTML code injection vulnerability in Android Application, Bosch Video Security, version 3.2.3. or earlier, when successf

Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.

laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messag

The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before

The Perfect Survey WordPress plugin before 1.5.2 does not sanitise and escape multiple parameters (id and filters[sessio

The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before o

The Domain Check WordPress plugin before 1.0.17 does not sanitise and escape the domain parameter before outputting it b

The Visual CSS Style Editor WordPress plugin before 7.5.4 does not sanitise and escape the wyp_page_type parameter befor

The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacu_selected_sub_tab_area pa

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests

The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not sanitise and escape POSted parameters sen

The Skins for Contact Form 7 WordPress plugin before 2.5.1 does not sanitise and escape the tab parameter before outputt

The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before outputing back in

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.69 does not sanitise and escape the updraft_restore

The Link Library WordPress plugin before 7.2.9 does not sanitise and escape the settingscopy parameter before outputting

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the

Ivanti Service Manager 2021.1 allows reflected XSS via the appName parameter associated with ConfigDB calls, such as in

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to multiple reflected cross site scripting vulner

The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly enco

A Cross Site Scripting (XSS) vulnerability exists in Codex before 1.4.0 via Notebook/Page name field, which allows malic

The Fotobook WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping and the use o

The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitiza

Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.

Cross-site Scripting (XSS) - Reflected in Packagist ptrofimov/beanstalk_console prior to 1.7.12.

The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back i

The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before ou

The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vul

QuickBox Pro v2.4.8 contains a cross-site scripting (XSS) vulnerability at "adminuseredit.php?usertoedit=XSS", as the us

Reflected cross-site scripting vulnerability in the attached file name of php_mailform versions prior to Version 1.40 al

Reflected cross-site scripting vulnerability in the checkbox of php_mailform versions prior to Version 1.40 allows a rem

Cross-site scripting vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to inject an

Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wi

Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.

Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.

A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP9 Security Patch 1). The integrated web

Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may exp

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that

A reflected cross-site-scripting attack in web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote un

Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in include/functions.inc.ph

Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected

Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: D

Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the f

The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape t

The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back

The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter bef

The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in

The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do no

The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back