CWE-79

IBM Aspera Web Application 1.9.14 PL1 is vulnerable to cross-site scripting. This vulnerability allows users to embed ar

Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the (1) R

A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticat

A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) could allow an unauthentic

An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to

Untis WebUntis before 2020.9.6 allows XSS in multiple functions that store information.

An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to

An improper neutralization of script-related HTML tags in a web page in FortiManager 6.2.0, 6.2.1, 6.2.2, and 6.2.3and F

An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.

A reflective cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.

A DOM-based cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1

Pexip Infinity before 17 allows an unauthenticated remote attacker to achieve stored XSS via management web interface vi

Pagure before 5.6 allows XSS via the templates/blame.html blame view.

cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564).

cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).

cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).

cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).

cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).

Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripti

Host Header Injection vulnerability in the http management interface in Brocade Fabric OS versions before v9.0.0 could a

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scr

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scr

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scr

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scr

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scr

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scr

The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow an attacker to tric

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scr

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scr

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scr

An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messag

In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. The attacker creat

An issue was discovered in MediaWiki 1.32.x through 1.34.x before 1.34.4. LogEventList::getFiltersDesc is insecurely usi

An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version o

XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex s

bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. Th

An issue was discovered in HFish 0.5.1. When a payload is inserted where the password is entered, XSS code is triggered

Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on

An issue was discovered in Hoosk CMS v1.8.0. There is a XSS vulnerability in install/index.php

A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer

The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on

Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScr

HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS). The vulnerability could be employed i

Insufficient output sanitization in Teltonika firmware TRB2_R_00.02.04.3 allows an unauthenticated attacker to conduct r

Froala Editor before 3.2.2 allows XSS via pasted content.

SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter.

An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when re

Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via BBCode.

Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO.