CWE-80 · Cross-site Scripting
Improper Neutralization of Script-Related HTML Tags in a Web Page
663CVEs
3exploited
10with a public check
14likely (EPSS 10%+)
SortMost likely exploited
663 CVEs with CWE-80 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2020-13965In CISA KEVExploitedAn issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a pr…Roundcube · Webmail · CVSS 6.3 · 2020-06-09 | 6.3 | 77% | 2020-06-09 |
| CVE-2018-19953In CISA KEVExploitedIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.…QNAP Systems Inc. · QTS · CVSS 6.1 · 2020-10-28 | 6.1 | 31% | 2020-10-28 |
| CVE-2018-19943In CISA KEVExploitedIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS…QNAP Systems Inc. · QTS · CVSS 8 · 2020-10-28 | 8.0 | 23% | 2020-10-28 |
| CVE-2026-50229CheckApache Tomcat - Cross-Site ScriptingApache Software Foundation · Apache Tomcat · CVSS 6.1 · 2026-06-29 | 6.1 | 4.1% | 2026-06-29 |
| CVE-2025-54589CheckCopyparty <=1.18.6 - Cross-Site Scripting9001 · copyparty · CVSS 6.3 · 2025-07-31 | 6.3 | 2.4% | 2025-07-31 |
| CVE-2023-44393CheckPiwigo - Cross-Site ScriptingPiwigo · Piwigo · CVSS 9.3 · 2023-10-09 | 9.3 | 1.3% | 2023-10-09 |
| CVE-2024-41810CheckTwisted - Open Redirect & XSStwisted · twisted · CVSS 6.1 · 2024-07-29 | 6.1 | 1.2% | 2024-07-29 |
| CVE-2026-52774CheckYesWiki Bazar Widget - Reflected XSS via 'id' ParameterYesWiki · yeswiki · CVSS 6.1 · 2026-09-04 | 6.1 | 0.7% | 2026-09-04 |
| CVE-2026-52773CheckYesWiki Archived Revision - Cross-Site ScriptingYesWiki · yeswiki · CVSS 6.1 · 2026-09-04 | 6.1 | 0.6% | 2026-09-04 |
| CVE-2026-24128CheckXWiki Platform Distribution Flavor Main - Cross-Site Scriptingxwiki · xwiki-platform · CVSS 6.5 · 2026-01-23 | 6.5 | 0.6% | 2026-01-23 |
| CVE-2026-40105CheckXWiki - Cross-Site Scriptingxwiki · xwiki-platform · CVSS 6.5 · 2026-04-15 | 6.5 | 0.5% | 2026-04-15 |
| CVE-2025-66472CheckXWiki DeleteApplication - Cross-Site Scriptingxwiki · xwiki-platform · CVSS 6.5 · 2025-12-10 | 6.5 | 0.5% | 2025-12-10 |
| CVE-2025-64764CheckAstro - Reflected XSS via server islands featurewithastro · astro · CVSS 7.1 · 2025-11-19 | 7.1 | 0.5% | 2025-11-19 |
| CVE-2022-21145A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can lead to arbitra…Lansweeper · lansweeper · CVSS 9.1 · 2022-04-14 | 9.1 | 78% | 2022-04-14 |
| CVE-2020-13562A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacke…Phpgacl Project · phpGACL · CVSS 9.6 · 2021-02-01 | 9.6 | 78% | 2021-02-01 |
| CVE-2020-13564A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacke…Phpgacl Project · phpGACL · CVSS 9.6 · 2021-02-01 | 9.6 | 76% | 2021-02-01 |
| CVE-2020-13563A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacke…Phpgacl Project · phpGACL · CVSS 9.6 · 2021-02-01 | 9.6 | 76% | 2021-02-01 |
| CVE-2025-30676Apache OFBiz: Stored XSS VulnerabilityApache Software Foundation · Apache OFBiz · CVSS 6.1 · 2025-04-01 | 6.1 | 68% | 2025-04-01 |
| CVE-2022-36094XWiki Platform Web Parent POM vulnerable to XSS in the attachment historyxwiki · xwiki-platform · CVSS 8.9 · 2022-09-08 | 8.9 | 65% | 2022-09-08 |
| CVE-2022-36096XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments listxwiki · xwiki-platform · CVSS 8.9 · 2022-09-08 | 8.9 | 60% | 2022-09-08 |
| CVE-2022-36097XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment formxwiki · xwiki-platform · CVSS 8.9 · 2022-09-08 | 8.9 | 58% | 2022-09-08 |
| CVE-2024-39363A cross-site scripting (xss) vulnerability exists in the login.cgi set_lang_CountryCode() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can…Wavlink · Wavlink AC3000 · CVSS 9.6 · 2025-01-14 | 9.6 | 49% | 2025-01-14 |
| CVE-2024-57004Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering…Roundcube · Webmail · CVSS 6.1 · 2025-02-03 | 6.1 | 41% | 2025-02-03 |
| CVE-2024-32484An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execu…Ankitects · Anki · CVSS 7.4 · 2024-07-22 | 7.4 | 21% | 2024-07-22 |
| CVE-2024-37732Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file.Anchorcms · Anchor Cms · CVSS 8.8 · 2024-06-24 | 8.8 | 17% | 2024-06-24 |
| CVE-2025-4278Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLabGitLab · GitLab · CVSS 8.7 · 2025-06-12 | 8.7 | 11% | 2025-06-12 |
| CVE-2025-30161OpenEMR Stored XSS in OpenEMR Bronchitis Formopenemr · openemr · CVSS 8.4 · 2025-03-31 | 8.4 | 11% | 2025-03-31 |
| CVE-2016-9500The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to informaiton exposureAccellion · FTP Server · 2018-07-13 | – | 5.4% | 2018-07-13 |
| CVE-2021-39348LearnPress – WordPress LMS Plugin <= 4.1.3.1 Authenticated Stored Cross-Site ScriptingLearnPress · LearnPress · CVSS 5.5 · 2021-10-21 | 5.5 | 5.2% | 2021-10-21 |
| CVE-2022-4953Elementor < 3.5.5 - Iframe InjectionElementor · Elementor Website Builder · 2023-08-14 | – | 3.4% | 2023-08-14 |
| CVE-2020-4047Authenticated XSS via media attachment page in WordPressWordPress · wordpress-develop · CVSS 6.8 · 2020-06-12 | 6.8 | 3.3% | 2020-06-12 |
| CVE-2020-4049Authenticated self-XSS via theme uploads in WordPressWordPress · wordpress-develop · CVSS 2.4 · 2020-06-12 | 2.4 | 2.5% | 2020-06-12 |
| CVE-2014-2353Cogent DataHub XSSCogent · DataHub · CVSS 7.1 · 2014-05-30 | 7.1 | 2.5% | 2014-05-30 |
| CVE-2020-4046Authenticated XSS through embed block in WordPressWordPress · wordpress-develop · CVSS 5.4 · 2020-06-12 | 5.4 | 2.1% | 2020-06-12 |
| CVE-2020-26218HTML Injection in touchbase.aipuncsky · touchbase.ai · CVSS 8 · 2020-11-11 | 8.0 | 1.9% | 2020-11-11 |
| CVE-2022-35278HTML Injection in ActiveMQ Artemis Web ConsoleApache Software Foundation · Apache ActiveMQ Artemis · 2022-08-23 | – | 1.9% | 2022-08-23 |
| CVE-2024-41947XWiki Platform XSS through conflict resolutionxwiki · xwiki-platform · CVSS 9.1 · 2024-07-31 | 9.1 | 1.7% | 2024-07-31 |
| CVE-2023-39217Improper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to enable a denial of service via network access.Zoom Video Communications, Inc. · Zoom SDK's · CVSS 5.3 · 2023-08-08 | 5.3 | 1.6% | 2023-08-08 |
| CVE-2022-39348Twisted vulnerable to NameVirtualHost Host header injectiontwisted · twisted · CVSS 5.4 · 2022-10-26 | 5.4 | 1.6% | 2022-10-26 |
| CVE-2022-21238A cross-site scripting (xss) vulnerability exists in the info.jsp functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary Javas…InHand Networks · InRouter302 · CVSS 5.4 · 2022-05-12 | 5.4 | 1.5% | 2022-05-12 |
| CVE-2020-5267Possible XSS vulnerability in ActionViewrails · actionview · CVSS 4 · 2020-03-19 | 4.0 | 1.5% | 2020-03-19 |
| CVE-2016-9493PHP forms generated using the PHP FormMail Generator are vulnerable to stored cross-site scriptingPHP FormMail · Generator · 2018-07-13 | – | 1.5% | 2018-07-13 |
| CVE-2021-32718Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UIrabbitmq · rabbitmq-server · CVSS 3.1 · 2021-06-28 | 3.1 | 1.4% | 2021-06-28 |
| CVE-2021-32719Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ federation management pluginrabbitmq · rabbitmq-server · CVSS 3.1 · 2021-06-28 | 3.1 | 1.4% | 2021-06-28 |
| CVE-2022-28648In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being renderedJetBrains · YouTrack · CVSS 5.7 · 2022-04-05 | 5.7 | 1.4% | 2022-04-05 |
| CVE-2020-5283XSS vulnerability in CVS show_subdir_lastmod supportviewvc · viewvc · CVSS 3.1 · 2020-04-03 | 3.1 | 1.4% | 2020-04-03 |
| CVE-2022-29251Cross-site Scripting in the Flamingo theme managerxwiki · xwiki-platform · CVSS 7.4 · 2022-05-25 | 7.4 | 1.3% | 2022-05-25 |
| CVE-2020-11001Possible XSS attack in Wagtailwagtail · wagtail · CVSS 5.8 · 2020-04-14 | 5.8 | 1.3% | 2020-04-14 |
| CVE-2018-19952If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Systems Inc. Music Station versions prior t…QNAP Systems Inc. · Music Station · 2020-11-02 | – | 1.3% | 2020-11-02 |
| CVE-2019-1010018Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The…Zammad GmbH · Zammad · 2019-07-16 | – | 1.3% | 2019-07-16 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.