Cross-site Scripting

Every one of the 19 is a mark on the map. Named now: 1 to 19, most at risk first.

1. Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80) vulnerability in the subject of emails which are…CVE-2018-1000154Zammad · 1.5% likely

   CWE-79

2. Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store add…CVE-2021-35298Zammad · 1.5% likely

   CWE-79

3. Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The…CVE-2019-1010018Zammad GmbH · 1.3% likely

   CWE-80

4. Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute.CVE-2021-35303Zammad · 0.8% likely

   CWE-79

5. An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. XSS can be triggered via malicious HTML in a chat message or the content of a ticket ar…CVE-2017-5621Zammad · 0.7% likely

   CWE-79

6. An XSS issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Attachments are opened in a new tab instead of getting downloaded. This creates an…CVE-2017-5620Zammad · 0.7% likely

   CWE-79

7. An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled.CVE-2021-42088Zammad · 0.6% likely

   CWE-79

8. An issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket.CVE-2020-26035Zammad · 0.5% likely

   CWE-79

9. An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the File Upload functionality in Zammad. The malicious JavaS…CVE-2020-10103Zammad · 0.5% likely

   CWE-79

10. An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Ticket functionality in Zammad. The malicious JavaScript…CVE-2020-10099Zammad · 0.5% likely

    CWE-79

11. An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Email functionality. The malicious JavaScript will execu…CVE-2020-10098Zammad · 0.5% likely

    CWE-79

12. An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket.CVE-2021-42092Zammad · 0.5% likely

    CWE-79

13. An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar.CVE-2021-42085Zammad · 0.5% likely

    CWE-79

14. Zammad: Improper neutralization of `srcset` attribute in IMG tags in ZammadCVE-2026-56735zammad · CVSS 5.3 · 0.4% likely

    CWE-82

15. Zammad: Stored XSS via unescaped option labels in the object attribute options context UICVE-2026-63216zammad · CVSS 5.3 · 0.2% likely

    CWE-80

16. Zammad: Cross-Site Scripting in Ticket NotificationsCVE-2026-56731zammad · CVSS 8.4 · 0.2% likely

    CWE-79

17. Zammad: Stored XSS in ticket article rendering in the new Vue-based interfaceCVE-2026-102345zammad · CVSS 5.1 · 0.2% likely

    CWE-79

18. Zammad improperly neutralizes of script-related HTML tags in ticket articlesCVE-2026-34718zammad · CVSS 5.3 · 0.2% likely

    CWE-80

19. Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attributeCVE-2026-84463zammad · CVSS 6.3 · 0.1% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.