CWE-79

Pinboard 1.0.6 theme for Wordpress has XSS.

Zimbra Collaboration before 8.6.0 patch5 has XSS.

Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS.

An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedu

A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wirin

In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyA

The user interface component of TIBCO Software Inc.'s TIBCO Patterns - Search contains multiple vulnerabilities that the

The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info

Dokeos 2.1.1 has multiple XSS issues involving "extra_" parameters in main/auth/profile.php.

Havalite CMS 1.1.7 has a stored XSS vulnerability

Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the (1) customList%5B0%5D.v

Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view,

JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.

XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gist

PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Buil

IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi

A Cross-site Scripting (XSS) vulnerability exists in FortiManager 5.2.1 and earlier and 5.0.10 and earlier via an unspec

Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files.

A cross-site scripting (XSS) vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attac

ProjectPier 0.8.8 has stored XSS

ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flag

ProjectPier 0.8.8 does not use the Secure flag for cookies

Linksys WRT310Nv2 2.0.0.1 is vulnerable to XSS.

Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's per

Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote

Multiple cross-site scripting (XSS) vulnerabilities in NetCracker Resource Management System before 8.2 allow remote aut

index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.

Orange HRM 2.7.1 allows XSS via the vacancy name.

The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability.

Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page.

Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject J

Cross-site scripting (XSS) vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web

Multiple cross-site scripting (XSS) vulnerabilities in the MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenti

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a speciall

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a speciall

Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field

Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a store

Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored

Jenkins Brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resu

IBM Rational Publishing Engine 6.0.6 and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users

Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS vers

Lexmark printer MS812 and multiple older generation Lexmark devices have a stored XSS vulnerability in the embedded web

Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject

XSS in Telligent Community 5.6.583.20496 via a flash file and related to the allowScriptAccess parameter.

PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XS

An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) base

The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key],

Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to

Codoforum 4.8.8 allows self-XSS via the title of a new topic.

Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header.