CWE-84 · Cross-site Scripting
Improper Neutralization of Encoded URI Schemes in a Web Page
21CVEs
1exploited
0with a public check
0likely (EPSS 10%+)
SortMost likely exploited
21 CVEs with CWE-84 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-96654In CISA KEVExploitedPlex Media Server < 1.43.3.10861 - Server Side Request ForgeryPlex · Media Server · CVSS 6.5 · 2026-09-23 | 6.5 | 13% | 2026-09-23 |
| CVE-2022-40181A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.12…Siemens · Desigo PXM30-1 · 2022-10-11 | – | 1.0% | 2022-10-11 |
| CVE-2020-7011Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injects a URL into a resu…Elastic · Elastic App Search · 2020-06-03 | – | 1.0% | 2020-06-03 |
| CVE-2021-3824OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL.Openvpn · OpenVPN Access Server · 2021-09-23 | – | 0.7% | 2021-09-23 |
| CVE-2025-58444MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Servermodelcontextprotocol · inspector · CVSS 8.6 · 2025-09-08 | 8.6 | 0.7% | 2025-09-08 |
| CVE-2023-25571Backstage has XSS Vulnerability in Software Catalogbackstage · backstage · CVSS 6.8 · 2023-02-14 | 6.8 | 0.5% | 2023-02-14 |
| CVE-2026-88859Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restrictionRed Hat · Red Hat Enterprise Linux 6 · CVSS 6.3 · 2026-09-10 | 6.3 | 0.4% | 2026-09-10 |
| CVE-2023-30959Stored XSS via javascript URI in Apollo Change Requests commentPalantir · com.palantir.apollo:autopilot · CVSS 4.1 · 2023-09-26 | 4.1 | 0.4% | 2023-09-26 |
| CVE-2025-30203Tuleap allows XSS via the content of RSS feeds in the RSS widgetsEnalean · tuleap · CVSS 4.8 · 2025-03-31 | 4.8 | 0.3% | 2025-03-31 |
| CVE-2026-67338JupyterLab before 4.5.9 Stored XSS via Extension Managerjupyterlab · jupyterlab · CVSS 6.1 · 2026-08-01 | 6.1 | 0.3% | 2026-08-01 |
| CVE-2024-45045JavaScript Injection via url encoded values in links in Collabora Office AndroidCollaboraOnline · online · CVSS 6.3 · 2024-08-29 | 6.3 | 0.3% | 2024-08-29 |
| CVE-2024-52890IBM Engineering Lifecycle Optimization - Publishing cross-site scriptingIBM · IBM Engineering Lifecycle Optimization - Publishing · CVSS 6.1 · 2025-08-05 | 6.1 | 0.2% | 2025-08-05 |
| CVE-2025-25334An issue in Suning Commerce Group Suning EMall iOS 9.5.198 allows attackers to access sensitive user information via supplying a crafted link.No vendor recorded · CVSS 5.5 · 2025-02-27 | 5.5 | 0.2% | 2025-02-27 |
| CVE-2025-25331An issue in Beitatong Technology LianJia iOS 9.83.50 allows attackers to access sensitive user information via supplying a crafted link.No vendor recorded · CVSS 5.5 · 2025-02-27 | 5.5 | 0.2% | 2025-02-27 |
| CVE-2025-25330An issue in Boohee Technology Boohee Health iOS 13.0.13 allows attackers to access sensitive user information via supplying a crafted link.No vendor recorded · CVSS 5.5 · 2025-02-27 | 5.5 | 0.2% | 2025-02-27 |
| CVE-2025-25329An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows attackers to access sensitive user information via supplying a crafted link.No vendor recorded · CVSS 5.5 · 2025-02-27 | 5.5 | 0.2% | 2025-02-27 |
| CVE-2025-25326An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user information via supplying a crafted link.No vendor recorded · CVSS 5.5 · 2025-02-27 | 5.5 | 0.2% | 2025-02-27 |
| CVE-2025-25325An issue in Yibin Fengguan Network Technology Co., Ltd YuPao DirectHire iOS 8.8.0 allows attackers to access sensitive user information via supplying a crafted link.No vendor recorded · CVSS 5.5 · 2025-02-27 | 5.5 | 0.2% | 2025-02-27 |
| CVE-2025-25324An issue in Shandong Provincial Big Data Center AiShanDong iOS 5.0.0 allows attackers to access sensitive user information via supplying a crafted link.No vendor recorded · CVSS 5.5 · 2025-02-27 | 5.5 | 0.2% | 2025-02-27 |
| CVE-2025-25323An issue in Qianjin Network Information Technology (Shanghai) Co., Ltd 51Job iOS 14.22.0 allows attackers to access sensitive user information via supplying a crafted link.No vendor recorded · CVSS 5.5 · 2025-02-27 | 5.5 | 0.2% | 2025-02-27 |
| CVE-2024-42184HCL BigFix Patch Download Plug-ins are affected by insecure support for file URI schemeHCL Software · BigFix Patch Management Download Plug-ins · CVSS 2.5 · 2025-01-23 | 2.5 | 0.1% | 2025-01-23 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.