CWE-79

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site script

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open optio

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in AKIN Software Comp

Crawl4AI before 0.8.7 contains a stored cross-site scripting vulnerability in the monitor dashboard that renders crawl U

A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a l

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, a reflected XSS vulnerability exists in t

The Image Sizes on Demand plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Server Varia

The EntreDroppers plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all ver

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText Access Ma

Cacti is an open source performance and fault management framework. Versions 1.2.30 and below contain a Reflected XSS vu

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Reflecte

K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both

A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script w

A stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Man

The MaxButtons – Create buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'view' para

Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions.

Mixpost through 2.6.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to e

Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cr

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, A

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Eksagate Electroni

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrar

Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrar

Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbi

Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who con

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrar

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrar

Storage Concentrator (SC & SCVM) is vulnerable to reflected cross-site scripting due to unsanitized content being echoed

The Wp Google Places Review Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'place'

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoi

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Raera - Ankara Web

The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back

Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to

showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitr

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/ta

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information

Lack of validation leads to an XSS vulnerability in the MFA management views.

Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.

Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.

Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.

Lack of escaping leads to an XSS vulnerability in the generic image output layout.

Improper validation leads to a generic XSS vector in the language override feature.

The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Refle