Cross-site Scripting

Every one of the 187 is a mark on the map. Named now: 1 to 26, most at risk first.

1. An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge re…CVE-2023-2442GitLab · CVSS 8.7 · 96% likely

   CWE-79

2. An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 befo…CVE-2023-0050GitLab · CVSS 8.7 · 92% likely

   CWE-79

3. Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing…CVE-2022-1190GitLab · CVSS 8.7 · 88% likely

   CWE-79

4. A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit…CVE-2022-3265GitLab · CVSS 7.3 · 87% likely

   CWE-79

5. Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 all…CVE-2022-1175GitLab · CVSS 8.7 · 82% likely

   CWE-79

6. An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS by using the design feature in issues.CVE-2021-22238GitLab · CVSS 6.8 · 72% likely

   CWE-79

7. An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job LogCVE-2020-13340GitLab · CVSS 8.7 · 67% likely

   CWE-791 bounty report

8. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVE-2023-2164GitLab · CVSS 5.4 · 66% likely

   CWE-79

9. Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-c…CVE-2021-22242GitLab · CVSS 8.7 · 64% likely

   CWE-79

10. Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf.CVE-2021-39906GitLab · CVSS 8.7 · 61% likely

    CWE-79

11. A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from 14.4 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to…CVE-2022-2230GitLab · CVSS 8.1 · 58% likely

    CWE-79

12. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVE-2024-1451GitLab · CVSS 8.7 · 51% likely

    CWE-79

13. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVE-2024-4901GitLab · CVSS 8.7 · 33% likely

    CWE-79

14. Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLabCVE-2025-4278GitLab · CVSS 8.7 · 11% likely

    CWE-80

15. A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 al…CVE-2022-1940GitLab · CVSS 7.7 · 6.3% likely

    CWE-791 bounty report

16. In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs pageCVE-2020-13288GitLab · CVSS 5.5 · 4.0% likely

    CWE-79

17. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVE-2024-6530GitLab · CVSS 7.3 · 2.2% likely

    CWE-79

18. Cross-site scripting (XSS) vulnerability in GitLab 6.0 and other versions before 6.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML file, as d…CVE-2013-7316Gitlab · 1.8% likely

    CWE-79

19. A Reflected Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code on the Static Site Editor in GitLab CE/EE 12.10 and later through 13.0.1CVE-2020-13269GitLab · CVSS 6.1 · 1.8% likely

    CWE-79

20. A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1CVE-2020-13267GitLab · CVSS 6.1 · 1.8% likely

    CWE-79

21. A Stored Cross-Site Scripting vulnerability allowed the execution of arbitrary Javascript code in the blobs API in all previous GitLab CE/EE versions through 13.0.1CVE-2020-13271GitLab · CVSS 6.1 · 1.6% likely

    CWE-79

22. An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 be…CVE-2022-1431GitLab · CVSS 4.3 · 1.5% likely

    CWE-79

23. An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious README page due to improper neutralisation…CVE-2022-4092GitLab · CVSS 5.7 · 1.3% likely

    CWE-79

24. An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is a persistent XSS vulnerability in…CVE-2018-19493Gitlab · 1.3% likely

    CWE-79

25. Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting.CVE-2017-0917GitLab · 1.3% likely

    CWE-79

26. An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.2.1. Label descriptions are vulnerable to HTML injection.CVE-2019-15724Gitlab · 1.2% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.