Skip to content
BackEsc
Sign in

CWE-79 · weakness in Cross-site Scripting

Cross-site Scripting

49,444 CVEs · 29 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
29
check available
981
likely to be exploited
459

Every one of the 49,444 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Barco/AWIND OEM Presentation Platform - Remote Command InjectionCVE-2019-3929Crestron · CVSS 9.8 · 99% likely

    Crestron

  2. Cisco ASA/FTD Software - Cross-Site ScriptingCVE-2020-3580Cisco · CVSS 6.1 · 86% likely

    Cisco

  3. Potential XSS vulnerability in jQueryCVE-2020-11023jquery · CVSS 6.9 · 85% likely

    Jquery

  4. Roundcube Webmail - Cross-Site ScriptingCVE-2024-42009Roundcube · CVSS 9.3 · 83% likelycovered by CyberSIXT

    RoundcubeUNK_MassTraction

  5. Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site ScriptingCVE-2023-34192Synacor · CVSS 9 · 77% likely

    Zimbra

  6. Stored XSS vulnerability in RoundcubeCVE-2023-5631Roundcube · CVSS 6.1 · 76% likely

    Roundcube

  7. Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.CVE-2024-37383Roundcube · CVSS 6.1 · 74% likely

    Roundcube

  8. WordPress Social Warfare <3.5.3 - Cross-Site ScriptingCVE-2019-9978WordPress · CVSS 6.1 · 73% likely

    WordPress

  9. Microsoft Exchange Server Spoofing VulnerabilityCVE-2026-42897Microsoft · CVSS 8.1 · 71% likelycovered by CyberSIXT

    MicrosoftLaundry Bear

  10. A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. E…CVE-2019-18426Facebook · CVSS 8.2 · 68% likely

    Meta (Facebook)

  11. Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_repl…CVE-2023-43770Roundcube · CVSS 6.1 · 64% likely

    Roundcube

  12. Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpSe…CVE-2013-5223D-Link · CVSS 5.4 · 51% likely

    D-Link

  13. Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site ScriptingCVE-2023-37580Synacor · CVSS 6.1 · 49% likely

    Zimbra

  14. OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.CVE-2021-26829OpenPLC · CVSS 5.4 · 48% likely

    OpenPLC

  15. Windows MSHTML Platform Spoofing VulnerabilityCVE-2024-43573Microsoft · CVSS 6.5 · 46% likely

    Microsoft

  16. An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To e…CVE-2022-39197Fortra · CVSS 6.1 · 44% likely

    Fortra

  17. Stored XSS vulnerability in MDaemon Email ServerCVE-2024-11182MDaemon · CVSS 5.3 · 33% likely

    MDaemon

  18. An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in…CVE-2020-35730Roundcube · CVSS 6.1 · 33% likely

    Roundcube

  19. Zimbra Collaboration Suite - Cross-site ScriptingCVE-2018-6882Synacor · CVSS 6.1 · 30% likely

    Zimbra

  20. Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.CVE-2025-68461Roundcube · CVSS 7.2 · 27% likelycovered by CyberSIXT

    Roundcube

  21. Zimbra Collaboration - Cross-Site Scripting (XSS)CVE-2024-27443Synacor · CVSS 6.1 · 25% likely

    Zimbra

  22. Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTM…CVE-2014-2120Cisco · CVSS 5.4 · 23% likely

    Cisco

  23. A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Seq…CVE-2024-44309Apple · CVSS 6.3 · 22% likely

    Apple

  24. Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.CVE-2025-66376Zimbra · CVSS 7.2 · 20% likelycovered by CyberSIXT

    ZimbraAPT28Laundry Bear

  25. Zimbra Collaboration (ZCS) - Cross Site ScriptingCVE-2022-27926Synacor · CVSS 6.1 · 18% likely

    Zimbra

  26. This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing maliciously crafted…CVE-2021-1879Apple · CVSS 6.1 · 7.1% likely

    Apple

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in