Improper Neutralization of Script-Related HTML Tags in a Web Page
CWE-80
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as <, >, and & that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
We track 65 vulnerabilities of this type. 95% are rated high or critical, and the average CVSS score is 8.0. 3 have been exploited in real attacks.
How this weakness is prevented
- Implementation: With Struts, write all data from form beans with the bean's filter attribute set to true.
Latest Improper Neutralization of Script-Related HTML Tags in a Web Page vulnerabilities
- 7.6 High severity
phpMyFAQ: Improper Neutralization of Input During Web Page Generation
phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malicious HTML content into the FAQ editor at `http[:]//localhost/admin/index[.]php?action=editentry`, resulting in a compl
- 7.5 High severity
2FAuth: Server-Side Request Forgery
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5.4.1 a SSRF and URI validation bypass issue. The endpoint at POST /api/v1/twofaccounts/preview allows
- 9.0 Critical severity
macro-pdfviewer: Improper Neutralization of Input During Web Page Generation
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole
- 7.1 High severity
CF7 WOW Styler: Improper Neutralization of Script-Related HTML Tags in a Web Page
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saleswonder Team: Tobias CF7 WOW Styler cf7-styler allows Reflected XSS.This issue affects CF7 WOW Styler: from n/a through <= 1.6.8.
- 8.7 High severity
osmedeus: Improper Neutralization of Input During Web Page Generation
Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting (XSS) occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server. When using a workflow that contains the summary module, i
- 8.3 High severity
norman: Improper Neutralization of Script-Related HTML Tags in a Web Page
A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely.
- 8.3 High severity
apiserver: Improper Neutralization of Script-Related HTML Tags in a Web Page
A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server's public API endpoint can be exploited, allowing an attacker to execute arbitrary JavaScript code in the victim browser
- 7.1 High severity
Broken Link Checker: Improper Neutralization of Script-Related HTML Tags in a Web Page
The Broken Link Checker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg in /app/admin-notices/features/class-view.php without appropriate escaping on the URL in all versions up to, and including, 2.4.0. This
- 8.2 High severity
Anki: Improper Neutralization of Input During Web Page Generation
An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share a malicious flas
- 7.5 High severity
khoj: Improper Neutralization of Special Elements used in a Command
Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user inputs. This can trigger Cross Site Scripting (XSS) via Prompt Injection from untrusted documents either i
- 8.9 High severity
ghtml: Improper Neutralization of Input During Web Page Generation
ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code and trigger a Cross-Site Scripting (XSS) vulnerability in some cases. Version 2.0.0 introduces changes to mitigate this
- 9.6 Critical severity
Froxlor: Improper Neutralization of Input During Web Page Generation
Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting (XSS) vulnerability was identified in the Failed Login Attempts Logging Feature of the Froxlor Application. An unauthenticated User can inject malicious
- 7.4 High severity
mediawiki: Improper Neutralization of Script-Related HTML Tags in a Web Page
An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. XSS can occur because of mishandling of the 0x1b character, as demonstrated by Special:RecentChanges#%1b0000000.
- 7.4 High severity
cmsimple: Improper Neutralization of Script-Related HTML Tags in a Web Page
Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Logout parameter under the Language section.
- 7.4 High severity
yapi: Improper Neutralization of Script-Related HTML Tags in a Web Page
A stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the body field.
- 7.1 High severity
Firefox for iOS: Improper Neutralization of Script-Related HTML Tags in a Web Page
Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. This vulnerability affects Firefox for iOS < 123.
- 7.1 High severity
kirby_cms: Improper Neutralization of Script-Related HTML Tags in a Web Page
An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is backend sanitization such
- 9.8 Critical severity
Zoom Desktop Client for Windows: Improper Neutralization of Script-Related HTML Tags in a Web Page
Improper input validation in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access.
- 9.0 Critical severity
xwiki-platform: Improper Neutralization of Input During Web Page Generation
The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone vie
- 9.0 Critical severity
xwiki-platform: Improper Neutralization of Input During Web Page Generation
XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history
- 7.5 High severity
NS WooCommerce Watermark: Improper Neutralization of Script-Related HTML Tags in a Web Page
An unprivileged user could use the functionality of the NS WooCommerce Watermark WordPress plugin through 2.11.3 to load images that hide malware for example from passing malicious domains to hide their trace, by making them pass through the vulnerable domain.
- 9.0 Critical severity
SambaBox: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Group Functionality of Profelis IT Consultancy SambaBox allows AUTHENTICATED user to cause execute arbitrary codes on the vulnerable server. This issue affects: Prof
- 6.1 Medium severity
QNAP NAS File Station Cross-Site Scripting Exploited
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on b
- 5.4 Medium severity
QNAP NAS File Station Cross-Site Scripting Exploited
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS
- 6.1 Medium severity
Roundcube Webmail Cross-Site Scripting (XSS) Exploited
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.