CWE-79 · Cross-site Scripting
Cross-site Scripting
49,454CVEs
29exploited
981with a public check
459likely (EPSS 10%+)
SortMost likely exploited
49,454 CVEs with CWE-79 as their weakness · the first 2,000 are paged here; the Atlas names every one
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2019-3929In CISA KEVExploitedBarco/AWIND OEM Presentation Platform - Remote Command InjectionCrestron · Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP… · CVSS 9.8 · 2019-04-30 | 9.8 | 99% | 2019-04-30 |
| CVE-2020-3580In CISA KEVExploitedCisco ASA/FTD Software - Cross-Site ScriptingCisco · Cisco Adaptive Security Appliance (ASA) Software · CVSS 6.1 · 2020-10-21 | 6.1 | 86% | 2020-10-21 |
| CVE-2020-11023In CISA KEVExploitedPotential XSS vulnerability in jQueryjquery · jQuery · CVSS 6.9 · 2020-04-29 | 6.9 | 85% | 2020-04-29 |
| CVE-2024-42009In CISA KEVExploitedRoundcube Webmail - Cross-Site ScriptingRoundcube · Webmail · CVSS 9.3 · 2024-08-05 | 9.3 | 83% | 2024-08-05 |
| CVE-2023-34192In CISA KEVExploitedZimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site ScriptingSynacor · Zimbra Collaboration Suite (ZCS) · CVSS 9 · 2023-07-06 | 9.0 | 77% | 2023-07-06 |
| CVE-2023-5631In CISA KEVExploitedStored XSS vulnerability in RoundcubeRoundcube · Roundcubemail · CVSS 6.1 · 2023-10-18 | 6.1 | 76% | 2023-10-18 |
| CVE-2024-37383In CISA KEVExploitedRoundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.Roundcube · Webmail · CVSS 6.1 · 2024-06-07 | 6.1 | 74% | 2024-06-07 |
| CVE-2019-9978In CISA KEVExploitedWordPress Social Warfare <3.5.3 - Cross-Site ScriptingWordPress · Social Warfare Plugin · CVSS 6.1 · 2019-03-24 | 6.1 | 73% | 2019-03-24 |
| CVE-2026-42897In CISA KEVExploitedMicrosoft Exchange Server Spoofing VulnerabilityMicrosoft · Microsoft Exchange Server 2016 Cumulative Update 23 · CVSS 8.1 · 2026-05-14 | 8.1 | 71% | 2026-05-14 |
| CVE-2019-18426In CISA KEVExploitedA vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. E…Facebook · WhatsApp Desktop · CVSS 8.2 · 2020-01-21 | 8.2 | 68% | 2020-01-21 |
| CVE-2023-43770In CISA KEVExploitedRoundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_repl…Roundcube · Webmail · CVSS 6.1 · 2023-09-22 | 6.1 | 64% | 2023-09-22 |
| CVE-2013-5223In CISA KEVExploitedMultiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitrary web script or HTML via the (1) ntpSe…D-Link · DSL-2760U · CVSS 5.4 · 2013-11-15 | 5.4 | 51% | 2013-11-15 |
| CVE-2023-37580In CISA KEVExploitedZimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site ScriptingSynacor · Zimbra Collaboration Suite (ZCS) · CVSS 6.1 · 2023-07-31 | 6.1 | 49% | 2023-07-31 |
| CVE-2021-26829In CISA KEVExploitedOpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.OpenPLC · ScadaBR · CVSS 5.4 · 2021-06-11 | 5.4 | 48% | 2021-06-11 |
| CVE-2024-43573In CISA KEVExploitedWindows MSHTML Platform Spoofing VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 6.5 · 2024-10-08 | 6.5 | 46% | 2024-10-08 |
| CVE-2022-39197In CISA KEVExploitedAn XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To e…Fortra · Cobalt Strike · CVSS 6.1 · 2022-09-22 | 6.1 | 44% | 2022-09-22 |
| CVE-2024-11182In CISA KEVExploitedStored XSS vulnerability in MDaemon Email ServerMDaemon · Email Server · CVSS 5.3 · 2024-11-15 | 5.3 | 33% | 2024-11-15 |
| CVE-2020-35730In CISA KEVExploitedAn XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in…Roundcube · Roundcube Webmail · CVSS 6.1 · 2020-12-28 | 6.1 | 33% | 2020-12-28 |
| CVE-2018-6882In CISA KEVExploitedZimbra Collaboration Suite - Cross-site ScriptingSynacor · Zimbra Collaboration Suite (ZCS) · CVSS 6.1 · 2018-03-27 | 6.1 | 30% | 2018-03-27 |
| CVE-2025-68461In CISA KEVExploitedRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.Roundcube · Webmail · CVSS 7.2 · 2025-12-18 | 7.2 | 27% | 2025-12-18 |
| CVE-2024-27443In CISA KEVExploitedZimbra Collaboration - Cross-Site Scripting (XSS)Synacor · Zimbra Collaboration Suite (ZCS) · CVSS 6.1 · 2024-08-12 | 6.1 | 25% | 2024-08-12 |
| CVE-2014-2120In CISA KEVExploitedCross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTM…Cisco · Adaptive Security Appliance (ASA) · CVSS 5.4 · 2014-03-19 | 5.4 | 23% | 2014-03-19 |
| CVE-2024-44309In CISA KEVExploitedA cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Seq…Apple · Safari · CVSS 6.3 · 2024-11-19 | 6.3 | 22% | 2024-11-19 |
| CVE-2025-66376In CISA KEVExploitedZimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.Zimbra · Collaboration · CVSS 7.2 · 2026-01-05 | 7.2 | 20% | 2026-01-05 |
| CVE-2022-27926In CISA KEVExploitedZimbra Collaboration (ZCS) - Cross Site ScriptingSynacor · Zimbra Collaboration Suite (ZCS) · CVSS 6.1 · 2022-04-20 | 6.1 | 18% | 2022-04-20 |
| CVE-2021-1879In CISA KEVExploitedThis issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing maliciously crafted…Apple · iOS and iPadOS · CVSS 6.1 · 2021-04-02 | 6.1 | 7.1% | 2021-04-02 |
| CVE-2012-0767In CISA KEVExploitedCross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Androi…Adobe · Flash Player · CVSS 6.1 · 2012-02-16 | 6.1 | 6.2% | 2012-02-16 |
| CVE-2025-27915In CISA KEVExploitedZimbra - Cross-Site Scripting via ICS FilesSynacor · Zimbra Collaboration Suite (ZCS) · CVSS 5.4 · 2025-03-12 | 5.4 | 4.1% | 2025-03-12 |
| CVE-2025-48700In CISA KEVExploitedAn issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to exe…Synacor · Zimbra Collaboration Suite (ZCS) · CVSS 6.1 · 2025-06-23 | 6.1 | 1.7% | 2025-06-23 |
| CVE-2018-12998CheckZoho manageengine - Cross-Site ScriptingZohocorp · Firewall Analyzer · 2018-06-29 | – | 99% | 2018-06-29 |
| CVE-2020-9496CheckApache OFBiz 17.12.03 - Cross-Site ScriptingApache · Apache OFBiz · 2020-07-15 | – | 99% | 2020-07-15 |
| CVE-2021-25299CheckNagios XI 5.7.5 - Cross-Site ScriptingNagios · Nagios Xi · 2021-02-15 | – | 98% | 2021-02-15 |
| CVE-2020-1943CheckApache OFBiz <=16.11.07 - Cross-Site ScriptingApache · Apache OFBiz · 2020-04-01 | – | 97% | 2020-04-01 |
| CVE-2021-26812CheckMoodle Jitsi Meet 2.7-2.8.3 - Cross-Site ScriptingJitsi · Meet · 2021-04-14 | – | 97% | 2021-04-14 |
| CVE-2025-4123CheckGrafana - XSS / Open Redirect / SSRF via Client Path TraversalGrafana · Grafana · CVSS 7.6 · 2025-05-22 | 7.6 | 97% | 2025-05-22 |
| CVE-2023-2948CheckOpenEMR < 7.0.1 - Cross-Site Scriptingopenemr · openemr/openemr · CVSS 8.3 · 2023-05-28 | 8.3 | 97% | 2023-05-28 |
| CVE-2020-12259CheckrConfig 3.9.4 - Cross-Site ScriptingRconfig · Rconfig · 2020-05-18 | – | 96% | 2020-05-18 |
| CVE-2020-12256CheckrConfig 3.9.4 - Cross-Site ScriptingRconfig · Rconfig · 2020-05-18 | – | 96% | 2020-05-18 |
| CVE-2022-2733CheckOpenemr < 7.0.0.1 - Cross-Site Scriptingopenemr · openemr/openemr · CVSS 9.6 · 2022-08-09 | 9.6 | 96% | 2022-08-09 |
| CVE-2020-2096CheckJenkins Gitlab Hook <=1.4.2 - Cross-Site ScriptingJenkins project · Jenkins Gitlab Hook Plugin · 2020-01-15 | – | 93% | 2020-01-15 |
| CVE-2021-38156CheckNagios XI < 5.8.6 - Cross-Site ScriptingNagios · Nagios Xi · 2021-09-15 | – | 93% | 2021-09-15 |
| CVE-2018-10095CheckDolibarr <7.0.2 - Cross-Site ScriptingDolibarr · Dolibarr · 2018-05-22 | – | 87% | 2018-05-22 |
| CVE-2020-35774Checktwitter-server Cross-Site ScriptingTwitter · Twitter-Server · 2020-12-29 | – | 86% | 2020-12-29 |
| CVE-2021-41174CheckGrafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scriptinggrafana · grafana · CVSS 6.9 · 2021-11-03 | 6.9 | 85% | 2021-11-03 |
| CVE-2023-44352CheckAdobe Coldfusion - Cross-Site ScriptingAdobe · ColdFusion · CVSS 6.1 · 2023-11-17 | 6.1 | 85% | 2023-11-17 |
| CVE-2023-3388CheckBeautiful Cookie Consent Banner < 2.10.2 - Cross-Site Scriptingnikelschubert · Beautiful Cookie Consent Banner · CVSS 7.2 · 2023-06-24 | 7.2 | 84% | 2023-06-24 |
| CVE-2019-14470CheckWordPress UserPro 4.9.32 - Cross-Site ScriptingInstagram-Php-Api Project · Instagram-Php-Api · 2019-09-04 | – | 83% | 2019-09-04 |
| CVE-2019-10092CheckApache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site ScriptingApache · Apache HTTP Server · 2019-09-26 | – | 81% | 2019-09-26 |
| CVE-2023-24488CheckCitrix Gateway and Citrix ADC - Cross-Site ScriptingCitrix · Citrix ADC and Citrix Gateway · CVSS 6.1 · 2023-07-10 | 6.1 | 81% | 2023-07-10 |
| CVE-2021-31250CheckCHIYU TCP/IP Converter - Cross-Site ScriptingChiyu-Tech · Bf-430 Firmware · 2021-06-04 | – | 80% | 2021-06-04 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.