CWE-80

High likelihood

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Parent: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

538 vulnerabilities with CWE-80
CVE-2026-28132 MEDIUM
WooCommerce Photo Reviews <=1.4.4 - XSS
CVSS 5.3
CVE-2026-27578 MEDIUM
n8n <2.10.1/2.9.3/1.123.22 - XSS
CVSS 5.4
CVE-2026-27116 MEDIUM
vikunja/vikunja < 2.0.0 - Reflected HTML Injection via Projects Filter Parameter
CVSS 6.1
CVE-2026-27458 MEDIUM
LinkAce < 2.4.3 - Authenticated Stored Cross-Site Scripting via List Description in Atom Feed
CVSS 5.4
CVE-2026-25006 MEDIUM
XStore <= 9.6.4 - Code Injection via Improper Neutralization of Script-Related HTML Tags
CVSS 5.3
CVE-2026-22422 MEDIUM
Everest Forms <= 3.4.1 - Code Injection via Improper Neutralization of Script-Related HTML Tags
CVSS 5.3
CVE-2026-25935 MEDIUM
vikunja/vikunja < 1.1.0 - Stored Cross-Site Scripting via Task Description Hover
CVSS 5.4
CVE-2026-1282 LOW
GitLab 18.6.0-18.6.5, 18.7.0-18.7.3, 18.8.0-18.8.3 - Authenticated Stored Cross-Site Scripting in Project Label Titles
CVSS 3.5
CVE-2026-25764 LOW
OpenProject < 16.6.7 - Authenticated HTML Injection in Time Tracking Work Package Name
CVSS 3.5
CVE-2026-22254 NONE
Winter CMS < 1.2.10 - Authenticated Stored Cross-Site Scripting via SVG Upload
CVE-2026-25578 MEDIUM
navidrome < 0.60.0 - Stored Cross-Site Scripting via Song Comment Metadata
CVSS 6.1
CVE-2026-25054 MEDIUM
n8n < 1.123.9 and 2.0.0-2.2.1 - Authenticated Stored Cross-Site Scripting in Markdown Renderer
CVSS 5.4
CVE-2026-24128 MEDIUM
XWiki Platform 7.0-milestone-2-16.10.11, 17.0.0-rc-1-17.4.4, 17.5.0-rc-1-17.7.0 - Reflected Cross-Site Scripting
CVSS 6.1
CVE-2026-24564 MEDIUM
Israpil Textmetrics <3.6.3 - Code Injection
CVSS 4.3
CVE-2026-22469 MEDIUM
DeepDigital <= 1.0.2 - Code Injection via Arbitrary Shortcode Execution
CVSS 5.3
CVE-2026-1154 MEDIUM
SourceCodester E-Learning System 1.0 - Cross-Site Scripting via Lesson Module Title/Description
CVSS 4.3
CVE-2026-23528 MEDIUM
Dask distributed < 2026.1.0 - Cross-Site Scripting via Jupyter Lab Dashboard Proxy
CVSS 6.1
CVE-2026-20047 MEDIUM
Cisco Identity Services Engine - Authenticated Stored Cross-Site Scripting in Web Management Interface
CVSS 4.8
CVE-2025-71310 LOW
Backdropcms Gdpr Cookies Module For Backdrop Cms < 1.x-1.3.5 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2025-15345 MEDIUM
MapGeo - Interactive Geo Maps <= 1.6.27 - Reflected Cross-Site Scripting via 'map' Parameter
CVSS 6.1
CVE-2025-59854 LOW
HCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability
CVSS 3.1
CVE-2025-66486 MEDIUM
IBM Aspera Shares 1.9.9-1.11.0 - HTML Injection
CVSS 4.8
CVE-2025-59540 MEDIUM
Chamilo LMS < 1.11.34 - Stored Cross-Site Scripting in Exercise History Feedback
CVSS 5.4
CVE-2025-52564 MEDIUM
Chamilo LMS < 1.11.30 - Cross-Site Scripting via help.php Open Parameter
CVSS 6.1
CVE-2025-52563 MEDIUM
Chamilo LMS < 1.11.30 - Reflected Cross-Site Scripting via Page Parameter
CVSS 6.1
Details
Vulnerabilities 538
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits