Improper Neutralization of Script-Related HTML Tags in a Web Page
CWE-80
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as <, >, and & that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
We track 65 vulnerabilities of this type. 95% are rated high or critical, and the average CVSS score is 8.0. 3 have been exploited in real attacks.
How this weakness is prevented
- Implementation: With Struts, write all data from form beans with the bean's filter attribute set to true.
Latest Improper Neutralization of Script-Related HTML Tags in a Web Page vulnerabilities
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Script-Related HTML Tags in a Web Page
In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Script-Related HTML Tags in a Web Page
In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes
- 8.7 High severity
groupoffice: Improper Neutralization of Input During Web Page Generation
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.172, 25.0.108, and 26.0.33, a low-privileged user can create manual reminders containing arbitrary HTML/JavaScript and assign them to any other user (inclu
- 7.5 High severity
mediawiki-extensions-EmbedVideo: Improper Neutralization of Input During Web Page Generation
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the ur
- 9.3 Critical severity
core: Improper Neutralization of Script-Related HTML Tags in a Web Page
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpo
- 7.0 High severity
gocd: Improper Neutralization of Script-Related HTML Tags in a Web Page
GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials when rendering the Stage Detail, Job/Build Detai
- 7.5 High severity
gocd: Improper Neutralization of Script-Related HTML Tags in a Web Page
GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-(.+). An attacker with c
- 8.5 High severity
cvat: Improper Neutralization of Script-Related HTML Tags in a Web Page
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in cvat-ui/src/audio/components/annotation-page/audio-workspace/top-bar/audio-right-group.tsx passes atta
- 8.6 High severity
Maps: Improper Neutralization of Input During Web Page Generation
Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources
- 8.9 High severity
cal.diy: Improper Neutralization of Script-Related HTML Tags in a Web Page
Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>) renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing
- 8.9 High severity
cal.diy: Improper Neutralization of Script-Related HTML Tags in a Web Page
Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /booking/<id>). Booking question (form field) labels are rendered via React's dangerouslySetInnerHTML wi
- 8.6 High severity
siyuan: Improper Neutralization of Script-Related HTML Tags in a Web Page
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, Asset.render in app/src/asset/index.ts interpolates the unsanitized this.path value into HTML assigned to innerHTML, allowing a crafted asset link containing a double quote to break
- 8.8 High severity
pretix: Improper Neutralization of Script-Related HTML Tags in a Web Page
Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of another backend user. Due
- 8.5 High severity
cvat: Improper Neutralization of Script-Related HTML Tags in a Web Page
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.5.0 to 2.63.0, an attacker who is able to create or edit an annotation guide on a task is able to add malicious JavaScript code, which will then run in the browser o
- 7.3 High severity
YAFNET: Improper Neutralization of Input During Web Page Generation
YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the thread posting and reply feature accepts user-supplied content via a a post or reply that is stored server-side and later rendered back into the thread page without adequate HT
- 8.1 High severity
YAFNET: Improper Neutralization of Input During Web Page Generation
YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the application's database logger (YAFNET.Core/Logger/DbLogger.cs) captures the incoming request's User-Agent header into a JObject, serializes it with JsonConvert, and stores the
- 8.8 High severity
DivvyDrive: Improper Neutralization of Script-Related HTML Tags in a Web Page
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Cross-Site Scripting (XSS). This issue affects DivvyDrive: from 4.8.2.9 before 4.8.3.2.
- 7.0 High severity
mailcow-dockerized: Improper Neutralization of Input During Web Page Generation
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the user dashboard's "Seen successful connections" (login history) renders the client IP from login logs without HTML escaping. Because the server trust
- 8.9 High severity
mailcow-dockerized: Improper Neutralization of Input During Web Page Generation
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the Quarantine details modal injects attachment filenames into HTML without escaping, allowing arbitrary HTML/JS execution. An attacker can deliver an e
- 9.3 Critical severity
mailcow-dockerized: Improper Neutralization of Input During Web Page Generation
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value (logged as the "user" field) without HTML escaping. By submitting an unauthenticat
- 8.1 High severity
CRM: Improper Neutralization of Input During Web Page Generation
ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting (XSS) vulnerability on the login page, which is caused by the lack of sanitization or encoding of the username parameter received from the URL. The
- 9.0 Critical severity
Anchorr: Improper Neutralization of Script-Related HTML Tags in a Web Page
Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector. Jellyseerr allows any account holder to
- 7.1 High severity
WP Photo Album Plus: Improper Neutralization of Script-Related HTML Tags in a Web Page
The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 9.1.05.008 due to insufficient input sanitization and output escaping. This makes it possible for u
- 9.6 Critical severity
deepchat: Improper Neutralization of Input During Web Page Generation
DeepChat is an open-source AI chat platform that supports cloud models and LLMs. Versions 0.5.1 and below are vulnerable to XSS attacks through improperly sanitized Mermaid content. The recent security patch for MermaidArtifact.vue is insufficient and can be b
- 7.6 High severity
Pingalert Application Server: Improper Neutralization of Script-Related HTML Tags in a Web Page
A Reflected Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to hijack user’s browser, capturing sensitive information.
- 7.1 High severity
TableOn: Improper Neutralization of Script-Related HTML Tags in a Web Page
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in RealMag777 TableOn posts-table-filterable allows Code Injection.This issue affects TableOn: from n/a through <= 1.0.5.1.
- 9.3 Critical severity
Container suse manager 5.0: Improper Neutralization of Script-Related HTML Tags in a Web Page
A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x86_64/server:latest: from ?
- 8.4 High severity
Checkmk: Improper Neutralization of Input During Web Page Generation
Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised remote site to inject malicious HTML code into service outputs in the central site. Affecting Checkmk before 2.4.0p14, 2.3.0p39, 2.2.0 and 2.1.0 (eol).
- 8.5 High severity
core: Improper Neutralization of Input During Web Page Generation
Home Assistant is open source home automation software that puts local control and privacy first. In versions 2025.1.0 through 2025.10.1, the energy dashboard is vulnerable to stored cross-site scripting. An authenticated user can inject malicious JavaScript c
- 7.2 High severity
Cookie Notice & Consent: Improper Neutralization of Script-Related HTML Tags in a Web Page
The Cookie Notice & Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uuid parameter in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthentica
- 7.1 High severity
Shaarli: Improper Neutralization of Input During Web Page Generation
Shaarli is a minimalist bookmark manager and link sharing service. Prior to 0.15.0, the input string in the cloud tag page is not properly sanitized. This allows the </title> tag to be prematurely closed, leading to a reflected Cross-Site Scripting (XSS) vulne
- 8.1 High severity
Firefox: Improper Neutralization of Script-Related HTML Tags in a Web Page
Thunderbird executed `javascript:` URLs when used in `object` and `embed` tags. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
- 9.0 Critical severity
xwiki-rendering: Improper Neutralization of Input During Web Page Generation
XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the `xdom+xml/current` syn
- 8.6 High severity
mediawiki-extensions-TabberNeue: Improper Neutralization of Input During Web Page Generation
TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `<tabber>` tag. Version 3.1.1
- 8.7 High severity
GitLab: Improper Neutralization of Script-Related HTML Tags in a Web Page
An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search page could lead to account takeover.
- 7.1 High severity
Videos: Improper Neutralization of Script-Related HTML Tags in a Web Page
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Aviplugins Videos allows Reflected XSS.This issue affects Videos: from n/a through 1.0.5.
- 7.6 High severity
HCL DevOps Deploy / HCL Launch: Improper Neutralization of Input During Web Page Generation
HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.
- 7.1 High severity
Improve My City: Improper Neutralization of Script-Related HTML Tags in a Web Page
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Improve My City Improve My City improve-my-city allows Reflected XSS.This issue affects Improve My City: from n/a through <= 1.6.
- 7.1 High severity
Apache Atlas: Improper Neutralization of Script-Related HTML Tags in a Web Page
An authenticated user can perform XSS and potentially impersonate another user. This issue affects Apache Atlas versions 2.3.0 and earlier. Users are recommended to upgrade to version 2.4.0, which fixes the issue.
- 8.6 High severity
mediawiki-extensions-TabberNeue: Improper Neutralization of Input During Web Page Generation
TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2.