CWE-80

High likelihood

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Parent: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

562 vulnerabilities with CWE-80
CVE-2026-44369 HIGH
CVAT: Stored XSS via annotation guides
CVE-2026-44259 MEDIUM
efw4.X: Stored XSS via previewServlet
CVSS 4.6
CVE-2026-41611 HIGH
Visual Studio Code Remote Code Execution Vulnerability
CVSS 7.8
CVE-2026-43939 HIGH
YAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread Viewers
CVSS 7.3
CVE-2026-43938 HIGH
YAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header
CVSS 8.1
CVE-2026-42451 MEDIUM
Grimmory: Stored XSS via Malicious EPUB Enables Session Token Theft
CVSS 6.3
CVE-2026-42030 MEDIUM
MapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewer
CVSS 6.1
CVE-2026-41575 MEDIUM
th30d4y/IP: DOM-Based Cross-Site Scripting (XSS) Vulnerability
CVSS 6.1
CVE-2026-44264 MEDIUM
Weblate is vulnerable to XSS via crafted Markdown
CVSS 4.3
CVE-2026-6002 HIGH
HTML Injection in DivvyDrive Information Technologies' DivvyDrive
CVSS 8.8
CVE-2026-40875 HIGH
mailcow: dockerized vulnerable to stored XSS in user login history real_rip
CVE-2026-40873 HIGH
mailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames
CVE-2026-40872 CRITICAL
mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field
CVE-2026-1564 MEDIUM
Pega Platform 8.1.0 to 25.1.1 - UI HTML Injection
CVSS 4.8
CVE-2026-20170 MEDIUM
Cisco Webex Contact Center - Unauthenticated Cross-Site Scripting
CVSS 6.1
CVE-2026-40105 MEDIUM
XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality
CVSS 6.1
CVE-2026-39425 MEDIUM
MaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering
CVSS 5.4
CVE-2026-26460 MEDIUM
Vtiger CRM 8.4.0 - HTML Injection in Dashboard Tab Parameter
CVSS 6.1
CVE-2026-33657 MEDIUM
EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field
CVSS 4.6
CVE-2026-39941 MEDIUM
ChurchCRM <7.1.0 EditEventAttendees.php - Cross-Site Scripting
CVSS 6.1
CVE-2026-34718 MEDIUM
Zammad improperly neutralizes of script-related HTML tags in ticket articles
CVSS 6.1
CVE-2026-39712 MEDIUM
WordPress tagDiv Composer plugin <= 5.4.3 - Arbitrary Shortcode Execution vulnerability
CVSS 5.3
CVE-2026-39629 MEDIUM
WordPress Uminex theme <= 1.0.9 - Arbitrary Shortcode Execution vulnerability
CVSS 5.3
CVE-2026-39628 MEDIUM
WordPress DukaMarket theme <= 1.3.0 - Arbitrary Shortcode Execution vulnerability
CVSS 5.3
CVE-2026-39626 MEDIUM
WordPress Armania theme <= 1.4.8 - Arbitrary Shortcode Execution vulnerability
CVSS 5.3
Details
Vulnerabilities 562
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits