CWE-692 · Cross-site Scripting
Incomplete Denylist to Cross-Site Scripting
7CVEs
0exploited
0with a public check
0likely (EPSS 10%+)
SortMost likely exploited
7 CVEs with CWE-692 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-20240A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS)…Cisco · Cisco IOS XE Software · CVSS 6.1 · 2025-09-24 | 6.1 | 0.4% | 2025-09-24 |
| CVE-2024-30924Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the checkin.php component.Derbynet · Derbynet · CVSS 4.6 · 2024-04-18 | 4.6 | 0.3% | 2024-04-18 |
| CVE-2024-42214HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. The OPTIONS method provides a list of the methods that are supported by the We…HCLSoftware · Aftermarket EPC · CVSS 5.3 · 2026-07-17 | 5.3 | 0.3% | 2026-07-17 |
| CVE-2025-49590CryptPad Dom-Based Cross-Site Scripting (XSS) Vulnerabilitycryptpad · cryptpad · CVSS 2.9 · 2025-06-18 | 2.9 | 0.3% | 2025-06-18 |
| CVE-2024-23569HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" headerHCLSoftware · Aftermarket EPC · CVSS 4.3 · 2026-07-17 | 4.3 | 0.3% | 2026-07-17 |
| CVE-2026-15295Ajax Load More <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scriptingdcooney · Ajax Load More – Infinite Scroll, Load More, & Lazy Load · CVSS 4.4 · 2026-07-10 | 4.4 | 0.2% | 2026-07-10 |
| CVE-2026-107396Indico: Cross-Site-Scripting in link fieldsindico · indico · CVSS 5.4 · 2026-10-08 | 5.4 | 0.2% | 2026-10-08 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.