CWE-83 · Cross-site Scripting
Improper Neutralization of Script in Attributes in a Web Page
35CVEs
0exploited
0with a public check
0likely (EPSS 10%+)
SortMost likely exploited
35 CVEs with CWE-83 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-37908org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerabilityxwiki · xwiki-rendering · CVSS 9.1 · 2023-10-25 | 9.1 | 1.1% | 2023-10-25 |
| CVE-2022-39262Stored Cross-Site Scripting (XSS) on login page in GLPIglpi-project · glpi · CVSS 5.2 · 2022-11-03 | 5.2 | 0.8% | 2022-11-03 |
| CVE-2025-4615PAN-OS: Improper Neutralization of Input in the Management Web InterfacePalo Alto Networks · Cloud NGFW · CVSS 5.4 · 2025-10-09 | 5.4 | 0.8% | 2025-10-09 |
| CVE-2023-32070Improper Neutralization of Script in Attributes in XWiki (X)HTML renderersxwiki · xwiki-rendering · CVSS 9.1 · 2023-05-10 | 9.1 | 0.7% | 2023-05-10 |
| CVE-2026-45118MyBB: Contact page reflected XSSmybb · mybb · CVSS 9.3 · 2026-08-18 | 9.3 | 0.5% | 2026-08-18 |
| CVE-2024-52595HTML Cleaner allows crafted scripts in special contexts like svg or math to pass throughfedora-python · lxml_html_clean · CVSS 7.7 · 2024-11-19 | 7.7 | 0.5% | 2024-11-19 |
| CVE-2020-14525Philips Clinical Collaboration Platform Improper Neutralization of Script in Attributes in a Web PagePhilips · Clinical Collaboration Platform · CVSS 3.5 · 2020-09-18 | 3.5 | 0.5% | 2020-09-18 |
| CVE-2025-27145copyparty renders unsanitized filenames as HTML when user uploads empty files9001 · copyparty · CVSS 3.6 · 2025-02-25 | 3.6 | 0.5% | 2025-02-25 |
| CVE-2026-45733Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop appTriliumNext · Trilium · CVSS 8.3 · 2026-08-18 | 8.3 | 0.4% | 2026-08-18 |
| CVE-2026-49276Kirby: Self cross-site scripting (self-XSS) in the writer fieldgetkirby · kirby · CVSS 7.4 · 2026-07-09 | 7.4 | 0.4% | 2026-07-09 |
| CVE-2025-0125PAN-OS: Improper Neutralization of Input in the Management Web InterfacePalo Alto Networks · Cloud NGFW · CVSS 6.9 · 2025-04-11 | 6.9 | 0.4% | 2025-04-11 |
| CVE-2025-0137PAN-OS: Improper Neutralization of Input in the Management Web InterfacePalo Alto Networks · Cloud NGFW · CVSS 4.8 · 2025-05-14 | 4.8 | 0.4% | 2025-05-14 |
| CVE-2023-30958DOM XSS in Developer mode dashboard via redirect GET parameterPalantir · com.palantir.foundry:foundry-frontend · CVSS 4.7 · 2023-08-03 | 4.7 | 0.4% | 2023-08-03 |
| CVE-2026-91127File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC rendererflyfish-dev · file-viewer · CVSS 8.2 · 2026-09-18 | 8.2 | 0.4% | 2026-09-18 |
| CVE-2026-59727Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islandswithastro · astro · CVSS 2.1 · 2026-07-27 | 2.1 | 0.4% | 2026-07-27 |
| CVE-2026-15920Potential cross-site scripting via URLField values in the admindjangoproject · Django · CVSS 6.1 · 2026-08-04 | 6.1 | 0.4% | 2026-08-04 |
| CVE-2026-62324Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSSxdan · jodit · CVSS 5.4 · 2026-07-31 | 5.4 | 0.3% | 2026-07-31 |
| CVE-2025-58746Volkov Labs Business Links plugin vulnerable to privilege escalation attackVolkovLabs · business-links · CVSS 9.1 · 2025-09-08 | 9.1 | 0.3% | 2025-09-08 |
| CVE-2026-53722Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URLnuxt · nuxt · CVSS 5.1 · 2026-06-12 | 5.1 | 0.3% | 2026-06-12 |
| CVE-2026-61791OCO-Server: Stored XSS through agent hostnames in command buttonsschorschii · OCO-Server · CVSS 7.4 · 2026-10-22 | 7.4 | 0.3% | 2026-10-22 |
| CVE-2024-26283An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. This vulnerability affec…Mozilla · Firefox for iOS · CVSS 7.8 · 2024-02-22 | 7.8 | 0.3% | 2024-02-22 |
| CVE-2026-58391OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakoutopnsense · core · CVSS 5.4 · 2026-10-15 | 5.4 | 0.3% | 2026-10-15 |
| CVE-2026-108260@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSStinacms · tinacms · CVSS 7.6 · 2026-10-09 | 7.6 | 0.3% | 2026-10-09 |
| CVE-2025-67163A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into th…Simplemachines · Simple Machines Forum · CVSS 6.1 · 2025-12-18 | 6.1 | 0.3% | 2025-12-18 |
| CVE-2026-112356GFI KerioConnect < 10.0.9p2 XSS via Link Auto-FormatterGFI USA, LLC · GFI KerioConnect · CVSS 6.1 · 2026-10-28 | 6.1 | 0.3% | 2026-10-28 |
| CVE-2026-22849Saleor lacks proper HTML sanitization in rich text fieldssaleor · saleor · CVSS 7.2 · 2026-01-21 | 7.2 | 0.2% | 2026-01-21 |
| CVE-2026-112353GFI KerioConnect < 10.0.8p2 Stored XSS via SVG AttachmentGFI USA, LLC · GFI KerioConnect · CVSS 8.2 · 2026-10-27 | 8.2 | 0.2% | 2026-10-27 |
| CVE-2024-9103Persistent XSS in blocked messagesForcepoint · Email Security · CVSS 6.1 · 2025-03-24 | 6.1 | 0.2% | 2025-03-24 |
| CVE-2026-58263Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrierxdan · jodit · CVSS 7.2 · 2026-07-01 | 7.2 | 0.2% | 2026-07-01 |
| CVE-2026-53841OpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Session HTMLOpenClaw · OpenClaw · CVSS 6.1 · 2026-06-16 | 6.1 | 0.2% | 2026-06-16 |
| CVE-2025-11682Stored Cross-Site Scripting in Perx Customer Engagement & Loyalty PlatformPerx Technologies · Customer Engagement & Loyalty Platform · CVSS 7.1 · 2025-10-27 | 7.1 | 0.2% | 2025-10-27 |
| CVE-2026-45669Nuxt: Reflected XSS in `navigateTo()` external redirectnuxt · nuxt · CVSS 5.3 · 2026-06-12 | 5.3 | 0.2% | 2026-06-12 |
| CVE-2026-23516CVAT vulnerable to XSS via skeleton SVG imagescvat-ai · cvat · CVSS 8.6 · 2026-01-21 | 8.6 | 0.2% | 2026-01-21 |
| CVE-2026-8245Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injectionConcrete CMS · Concrete CMS · CVSS 6 · 2026-05-21 | 6.0 | 0.1% | 2026-05-21 |
| CVE-2026-48591Stored XSS via unescaped HTML attribute values in earmarkpragdave · earmark · CVSS 4.8 · 2026-06-17 | 4.8 | 0.1% | 2026-06-17 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.