CWE-79

The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before ren

The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields befor

OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that al

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that al

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outp

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML at

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an aut

The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it o

Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability in the Markdown parser extension that

Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management mod

Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.

Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdo

Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without outp

A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sani

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tapandsign

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, a Cross-S

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia F

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665.

HTML Injection can be carried out in Product when a web application does not properly check or clean user input before s

DiceBear is an avatar library for designers and developers. Starting in version 5.0.0 and prior to versions 5.4.4, 6.1.4

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam b

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolve

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

The Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `form_ids` parameter in t

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.10, DOMSanitizer::sanitize() allows <style

The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Stor

ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage.

i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes.

Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based

Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Rou

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the

SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certai

The Open User Map PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'oum_location_notificati

Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who ha

CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_typ

Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeave

Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). The issue occurs becaus

WWBN AVideo is an open source video platform. Versions 29.0 and below contain a stored Cross-Site Scripting vulnerabilit

secure_headers manages application of security headers with many safe defaults. Prior to 7.3.0, secure_headers builds th

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 1

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Sit

jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectl

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated requ

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate optio