cve.bz

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), page 57

Filter

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

What the weakness is: CWE-79 at MITRE

Ask an AI about CWE-79

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-79: Improper Neutralization of Input During Web Page Generation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/79.html and https://cve.bz/cve/cwe/79?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.2CVE-2026-63135EPSS 0.4%

    YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the va…

  2. 8.2CVE-2026-61824EPSS 0.4%

    Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse()…

  3. 8.0CVE-2026-31880EPSS 0.4%

    Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.

  4. 8.0CVE-2026-31803EPSS 0.4%

    Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.

  5. 8.0CVE-2026-30890EPSS 0.4%

    Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue has been fixed in version 3.2.3.

  6. 7.1CVE-2026-30865EPSS 0.3%

    Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.

  7. 8.0CVE-2026-30826EPSS 0.4%

    Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3.

  8. 8.6CVE-2026-74252EPSS 0.5%

    Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting (XSS) through the guest checkout billing address fields. An…

  9. 5.3CVE-2026-50290EPSS 0.5%

    SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped `expression(` and `url(javascript:` using simple regex, but could be bypassed with CSS unicode escapes (`\65xpression…

  10. 7.3CVE-2026-30819EPSS 0.4%

    Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS) vulnerability in its dashboard revert functionality with the parameter dashboard_id in /pages/ajax.render.php. This iss…

  11. 5.3CVE-2026-55850EPSS 0.5%

    Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without…

  12. 8.2CVE-2026-54682EPSS 0.2%

    DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExport…

  13. 4.1CVE-2026-54681EPSS 0.2%

    DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title at…

  14. 8.5CVE-2026-75933EPSS 0.4%

    Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain.

  15. 5.3CVE-2026-77028EPSS 0.4%

    Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66

  16. 8.6CVE-2026-76612EPSS 0.4%

    Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.

  17. 5.1CVE-2026-73537EPSS 0.3%

    Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component (WebView) running on the affected product, resulting in the displayed conten…

  18. 3.5CVE-2026-14325EPSS 0.2%

    The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbit…

  19. 7.5CVE-2026-65644EPSS 0.5%

    Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This na…

  20. 7.2CVE-2026-18409EPSS 0.3%

    The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping…

  21. 4.4CVE-2026-77643EPSS 0.3%

    A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a mis…

  22. 5.4CVE-2026-55491EPSS 0.3%

    BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged use…

  23. 2.0CVE-2026-54505EPSS 0.6%

    TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx a…

  24. 7.3CVE-2026-49436EPSS 0.4%

    LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (`POST /api/v2/bulk/links`) accepts URLs without any format validation, allowing an authenticated user to store a `javascript:` U…

  25. 3.7CVE-2026-49245EPSS 0.3%

    SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing …

  26. 4.8CVE-2026-77506EPSS 0.2%

    Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.

  27. 4.7CVE-2026-68921EPSS 0.3%

    DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while …

  28. 4.4CVE-2026-75526EPSS 0.3%

    django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values t…

  29. 8.6CVE-2026-50190EPSS 0.4%

    Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/controller/visitor/BookmarkListController.php`. The `permalink` handler concatenates the raw `$bookmark->getTitle()` int…

  30. 5.4CVE-2026-73259EPSS 0.4%

    Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST and persuade a user to visit it. The mg_http_serve_dir() and l…

  31. 5.4CVE-2026-73254EPSS 0.3%

    Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST…

  32. 8.2CVE-2026-49825EPSS 0.3%

    lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. conten…

  33. 4.8CVE-2026-64972EPSS 0.4%

    ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break out of the attribute value, and append a new event handler such as onload. The re…

  34. 4.8CVE-2026-64971EPSS 0.5%

    ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported a…

  35. 5.1CVE-2026-64970EPSS 0.5%

    ATutor is vulnerable to Stored Cross Site Scripting in registration functionality.  An attacker can register a new account and enter a JavaScript payload in the phone field during registration. When any authenticated user visits the attack…

  36. 8.4CVE-2026-77072EPSS 0.3%

    n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redir…

  37. 6.5CVE-2026-73402EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.

  38. 7.1CVE-2026-68564EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.

  39. 7.1CVE-2026-66673EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.

  40. 7.1CVE-2026-66616EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.49.

  41. 7.1CVE-2026-66615EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.

  42. 7.1CVE-2026-66614EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.

  43. 7.1CVE-2026-66612EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.

  44. 7.1CVE-2026-66611EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.

  45. 7.1CVE-2026-66607EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.

  46. 7.1CVE-2026-66606EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.

  47. 7.1CVE-2026-66605EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.

  48. 7.1CVE-2026-66604EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.

  49. 6.5CVE-2026-66601EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.

  50. 7.1CVE-2026-66598EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.