Skip to content
BackEsc
Sign in

CWE-80 · weakness in Cross-site Scripting

Improper Neutralization of Script-Related HTML Tags in a Web Page

663 CVEs · 3 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
3
check available
10
likely to be exploited
14

Every one of the 663 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a pr…CVE-2020-13965Roundcube · CVSS 6.3 · 77% likely

    Roundcube

  2. If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.…CVE-2018-19953QNAP Systems Inc. · CVSS 6.1 · 31% likely

    QNAP

  3. If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS…CVE-2018-19943QNAP Systems Inc. · CVSS 8 · 23% likely

    QNAP

  4. Apache Tomcat - Cross-Site ScriptingCVE-2026-50229Apache Software Foundation · CVSS 6.1 · 4.1% likely

    Apache

  5. Copyparty <=1.18.6 - Cross-Site ScriptingCVE-2025-545899001 · CVSS 6.3 · 2.4% likely

    9001

  6. Piwigo - Cross-Site ScriptingCVE-2023-44393Piwigo · CVSS 9.3 · 1.3% likely

    Piwigo

  7. Twisted - Open Redirect & XSSCVE-2024-41810twisted · CVSS 6.1 · 1.2% likely

    Twisted

  8. YesWiki Bazar Widget - Reflected XSS via 'id' ParameterCVE-2026-52774YesWiki · CVSS 6.1 · 0.7% likely

    YesWiki

  9. YesWiki Archived Revision - Cross-Site ScriptingCVE-2026-52773YesWiki · CVSS 6.1 · 0.6% likely

    YesWiki

  10. XWiki Platform Distribution Flavor Main - Cross-Site ScriptingCVE-2026-24128xwiki · CVSS 6.5 · 0.6% likely

    Xwiki

  11. XWiki - Cross-Site ScriptingCVE-2026-40105xwiki · CVSS 6.5 · 0.5% likely

    Xwiki

  12. XWiki DeleteApplication - Cross-Site ScriptingCVE-2025-66472xwiki · CVSS 6.5 · 0.5% likely

    Xwiki

  13. Astro - Reflected XSS via server islands featureCVE-2025-64764withastro · CVSS 7.1 · 0.5% likely

    Withastro

  14. A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can lead to arbitra…CVE-2022-21145Lansweeper · CVSS 9.1 · 78% likely

    Lansweeper

  15. A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacke…CVE-2020-13562phpGACL · CVSS 9.6 · 78% likely
  16. A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacke…CVE-2020-13564phpGACL · CVSS 9.6 · 76% likely
  17. A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacke…CVE-2020-13563phpGACL · CVSS 9.6 · 76% likely
  18. Apache OFBiz: Stored XSS VulnerabilityCVE-2025-30676Apache Software Foundation · CVSS 6.1 · 68% likely

    Apache

  19. XWiki Platform Web Parent POM vulnerable to XSS in the attachment historyCVE-2022-36094xwiki · CVSS 8.9 · 65% likely

    Xwiki

  20. XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments listCVE-2022-36096xwiki · CVSS 8.9 · 60% likely

    Xwiki

  21. XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment formCVE-2022-36097xwiki · CVSS 8.9 · 58% likely

    Xwiki

  22. A cross-site scripting (xss) vulnerability exists in the login.cgi set_lang_CountryCode() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can…CVE-2024-39363Wavlink · CVSS 9.6 · 49% likely

    Wavlink

  23. Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering…CVE-2024-57004Roundcube · CVSS 6.1 · 41% likely

    Roundcube

  24. An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execu…CVE-2024-32484Ankitects · CVSS 7.4 · 21% likely

    Ankitects

  25. Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file.CVE-2024-37732Anchorcms · CVSS 8.8 · 17% likely
  26. Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLabCVE-2025-4278GitLab · CVSS 8.7 · 11% likely

    GitLab

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in