cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 50

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Ask an AI about CWE-79

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.1CVE-2026-85593EPSS 0.2%

    phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks() that calls html_entity_decode() on sanitized FAQ content, reversing entity-encoding protection. Authenticated users …

  2. 5.3CVE-2026-85577EPSS 0.3%

    AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with </script>. Attackers can craft a m…

  3. 5.4CVE-2026-18957EPSS 0.2%

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Menulux Software Inc. Menulux Portal allows Stored XSS. This issue affects Menulux Portal: before 20260903211448.

  4. 4.8CVE-2026-85541EPSS 0.3%

    DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website.

  5. 6.5CVE-2026-27086EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8.

  6. 6.1CVE-2026-85229EPSS 0.3%Unsupported when assigned

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster UI. This issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0. Users are recommended to upgrad…

  7. 6.1CVE-2026-80190EPSS 0.3%

    Apache Allura: stored XSS via SVN code repositories.  Git repositories are not known to be affected.  The vulnerability is likely mitigated via default CSP headers. This issue affects Apache Allura: through 1.20.0. Users are recommen…

  8. 6.1CVE-2026-80180EPSS 0.3%

    Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

  9. 2.0CVE-2026-85406EPSS 0.3%

    A vulnerability has been found in Eleveo Quality Management 9.7.0. This vulnerability affects unknown code of the component Conversation Review. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible.…

  10. 2.0CVE-2026-85405EPSS 0.3%

    A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/roleAddAction.do. Executing a manipulation of the argument name/username can lead to cross site scripting. The attack may be l…

  11. 2.1CVE-2026-85382EPSS 0.5%

    A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Impacted is the function htmlspecialchars_decode of the file App/Home/View/Default/Chapter/oneChapter.tpl of t…

  12. 5.3CVE-2026-85453EPSS 0.3%

    MOOS core-moos through 10.4.0 fails to escape database contents when rendering MOOSDB HTTP pages, allowing attackers to inject malicious scripts. Any MOOS publisher can set variable values containing script payloads that execute in the bro…

  13. 10.0CVE-2026-85061EPSS 0.5%

    MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collecti…

  14. 2.0CVE-2026-85207EPSS 0.3%

    A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack…

  15. 5.1CVE-2026-82024EPSS 0.2%

    LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz qu…

  16. 6.5CVE-2026-85303EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7.

  17. 6.5CVE-2026-85302EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a th…

  18. 7.1CVE-2026-84848EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.

  19. 7.1CVE-2026-84812EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.

  20. 6.1CVE-2026-84774EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.

  21. 7.2CVE-2026-84773EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.

  22. 7.1CVE-2026-84765EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.

  23. 7.1CVE-2026-84763EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.

  24. 7.1CVE-2026-81776EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions.

  25. 7.1CVE-2026-81773EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions.

  26. 7.1CVE-2026-81300EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.

  27. 7.1CVE-2026-81295EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.

  28. 7.1CVE-2026-81292EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.

  29. 6.5CVE-2026-81282EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions.

  30. 6.5CVE-2026-81281EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions.

  31. 5.3CVE-2026-85230EPSS 0.3%

    A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a r…

  32. 6.1CVE-2026-85227EPSS 0.3%

    MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML esc…

  33. 5.1CVE-2026-56128EPSS 1.1%

    pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored …

  34. 5.1CVE-2026-56127EPSS 1.1%

    pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The firewall rule description is stored in…

  35. 5.1CVE-2026-56126EPSS 1.1%

    pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including g…

  36. 5.8CVE-2026-84815EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects Enfold: from n/a through 8.0.

  37. 5.3CVE-2026-85159EPSS 0.3%

    AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauth…

  38. 5.3CVE-2026-85158EPSS 0.3%

    AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with --> and inject arbit…

  39. 2.0CVE-2026-85022EPSS 0.4%

    A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. …

  40. 2.1CVE-2026-85021EPSS 0.5%

    A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(shareLayout)/components/splash.tsx of the component Splash Layout. This manipulation of the argument redirect_url causes…

  41. 5.3CVE-2026-78000EPSS 0.5%

    Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom` and `priceto` in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a base64-encoded URL from user input and redirected to it withou…

  42. 9.2CVE-2026-76178EPSS 0.4%

    A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently st…

  43. 6.4CVE-2026-3852EPSS 0.3%

    The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization fail…

  44. 6.4CVE-2026-2573EPSS 0.3%

    The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘postBodyCss’ parameter in all versions up to, and including, 2.4.4 due to ins…

  45. 5.1CVE-2026-75134EPSS 0.3%

    SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly per…

  46. 5.4CVE-2026-84677EPSS 0.2%

    Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugin download index pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable …

  47. 8.8CVE-2026-84673EPSS 0.6%

    Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resu…

  48. 8.0CVE-2026-84665EPSS 0.4%

    Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulne…

  49. 8.8CVE-2026-84648EPSS 0.6%

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers in cont…

  50. 6.8CVE-2026-83547EPSS 0.4%

    The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Sc…