Incomplete Denylist to Cross-Site Scripting

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

1. A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS)…CVE-2025-20240Cisco · CVSS 6.1 · 0.4% likely

   Cisco

2. Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the checkin.php component.CVE-2024-30924Derbynet · CVSS 4.6 · 0.3% likely
3. HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. The OPTIONS method provides a list of the methods that are supported by the We…CVE-2024-42214HCLSoftware · CVSS 5.3 · 0.3% likely

   HCLSoftware

4. CryptPad Dom-Based Cross-Site Scripting (XSS) VulnerabilityCVE-2025-49590cryptpad · CVSS 2.9 · 0.3% likely
5. HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" headerCVE-2024-23569HCLSoftware · CVSS 4.3 · 0.3% likely

   HCLSoftware

6. Ajax Load More <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingCVE-2026-15295dcooney · CVSS 4.4 · 0.2% likely

   Dcooney

7. Indico: Cross-Site-Scripting in link fieldsCVE-2026-107396indico · CVSS 5.4 · 0.2% likely

   Indico

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.