CWE-80— Improper Neutralization of Script-Related HTML Tags

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.— MITRE CWE catalog

668 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-80page 7 of 14

CVE-2018-19942MEDIUMCVSS 6.1EG 6.1
2021-04-16
A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the fol…
CVE-2021-1351MEDIUMCVSS 6.1EG 6.1
2021-02-17
A vulnerability in the web-based interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of the affected service. The vulner…
CVE-2020-2502MEDIUMCVSS 6.1EG 6.1
2021-02-17
This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. Photo Station 6.0.11 and later
CVE-2020-2498MEDIUMCVSS 6.1EG 6.1
2020-12-10
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in certificate configuration. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS he…
CVE-2020-2497MEDIUMCVSS 6.1EG 6.1
2020-12-10
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero …
CVE-2020-2496MEDIUMCVSS 6.1EG 6.1
2020-12-10
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.147…
CVE-2020-2495MEDIUMCVSS 6.1EG 6.1
2020-12-10
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.147…
CVE-2020-2494MEDIUMCVSS 6.1EG 6.1
2020-12-10
This cross-site scripting vulnerability in Music Station allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in the following versions of Music Station. QuTS hero h4.5.1: Music Station 5.3.13 and la…
CVE-2020-2493MEDIUMCVSS 6.1EG 6.1
2020-12-10
This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in Multimedia Console 1.1.5 and later.
CVE-2020-2491MEDIUMCVSS 6.1EG 6.1
2020-12-10
This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. QTS 4.5.1: Photo Station 6.0.12 and later …
CVE-2020-27126MEDIUMCVSS 6.1EG 6.1
2020-11-18
A vulnerability in an API of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to improper validation of user-supplied input to an application programmati…
CVE-2018-19956MEDIUMCVSS 6.1EG 6.1
2020-11-02
The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Statio…
CVE-2018-19955MEDIUMCVSS 6.1EG 6.1
2020-11-02
The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Statio…
CVE-2018-19954MEDIUMCVSS 6.1EG 6.1
2020-11-02
The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Statio…
CVE-2018-19951MEDIUMCVSS 6.1EG 6.1
2020-11-02
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.
CVE-2020-12811MEDIUMCVSS 6.1EG 6.1
2020-09-24
A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable
CVE-2020-15788MEDIUMCVSS 6.1EG 6.1
2020-09-09
A vulnerability has been identified in Polarion Subversion Webclient (All versions). The Polarion subversion web application does not filter user input in a way that prevents Cross-Site Scripting. If a user is enticed into passing speciall…
CVE-2020-10043MEDIUMCVSS 6.1EG 6.1
2020-07-14
A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). The web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessi…
CVE-2020-7575MEDIUMCVSS 6.1EG 6.1
2020-04-14
A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions < V11.32). A persistent cross-site scripting (XSS) vulnerability exists in the web server access log page …
CVE-2020-7579MEDIUMCVSS 6.1EG 6.1
2020-03-10
A vulnerability has been identified in Spectrum Power™ 5 (All versions < v5.50 HF02). The web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is re…
CVE-2019-6585MEDIUMCVSS 6.1EG 6.1
2020-03-10
A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All versions >= V3.0 and < V4.1), SCALANCE S627-2M (All versions >= V3.0 and < V4.1). T…
CVE-2019-1010018MEDIUMCVSS 6.1EG 6.1
2019-07-16
Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The attack vector is: the victim must open a ticket. The fixed v…
CVE-2019-10933MEDIUMCVSS 6.1EG 6.1
2019-07-11
A vulnerability has been identified in Spectrum Power 3 (Corporate User Interface) (All versions <= v3.11), Spectrum Power 4 (Corporate User Interface) (Version v4.75), Spectrum Power 5 (Corporate User Interface) (All versions < v5.50), Sp…
CVE-2016-9500MEDIUMCVSS 6.1EG 6.1
2018-07-13
Accellion FTP server prior to version FTA_9_12_220 uses the Accusoft Prizm Content flash component, which contains multiple parameters (customTabCategoryName, customButton1Image) that are vulnerable to cross-site scripting.
CVE-2016-9493MEDIUMCVSS 6.1EG 6.1
2018-07-13
The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to stored cross-site scripting. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. This …
CVE-2018-4848MEDIUMCVSS 6.1EG 6.1
2018-06-14
A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.3), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.4.1), SCALANCE X-200RNA switch family (…
CVE-2017-16043MEDIUMCVSS 6.1EG 6.1
2018-06-04
Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3.
CVE-2017-16015MEDIUMCVSS 6.1EG 6.1
2018-06-04
Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize html on behalf of forms, use of forms may be vulnerable to cross site scripting
CVE-2006-0149MEDIUMCVSS 6.1EG 6.1
2006-01-09
Cross-site scripting (XSS) vulnerability in SimpBook 1.0, with html_enable on (the default), allows remote attackers to inject arbitrary web script or HTML via the message field.
CVE-2023-3481MEDIUMCVSS 5.7EG 6.1
2023-08-21
Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend upgrading to version 0.0.20 of the extension.
CVE-2022-1293MEDIUMCVSS 5.7EG 6.1
2022-08-02
The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions.
CVE-2008-10001MEDIUMCVSS 5.5EG 6.1
2022-03-28
A vulnerability, which was classified as problematic, has been found in Pro2col Stingray FTS. The manipulation of the argument Username leads to cross site scripting. The attack may be initiated remotely. It is recommended to upgrade the a…
CVE-2025-47600MEDIUMCVSS 5.3EG 6.1
2026-01-22
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in xtemos WoodMart woodmart allows Code Injection.This issue affects WoodMart: from n/a through <= 8.3.7.
CVE-2003-5003MEDIUMCVSS 5.0EG 6.1
2022-03-28
A vulnerability was found in ISS BlackICE PC Protection. It has been rated as problematic. Affected by this issue is the Update Handler. The manipulation with an unknown input leads to cross site scripting. The attack may be launched remot…
CVE-2025-62936MEDIUMCVSS 4.3EG 6.1
2025-10-27
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Jthemes xSmart xsmart allows Code Injection.This issue affects xSmart: from n/a through <= 1.2.9.4.
CVE-2022-35850MEDIUMCVSS 4.3EG 6.1
2023-04-11
An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6.3.3, all versions of 6.2 and 6.1 may allow a remote unauthenticated attacker to…
CVE-2017-20140MEDIUMCVSS 4.3EG 6.1
2022-07-22
A vulnerability was found in Itech Movie Portal Script 7.36. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /movie.php. The manipulation of the argument f with the input <img src=i onerro…
CVE-2017-20058MEDIUMCVSS 4.3EG 6.1
2022-06-20
A vulnerability classified as problematic was found in Elefant CMS 1.3.12-RC. Affected by this vulnerability is an unknown functionality of the component Version Comparison. The manipulation leads to basic cross site scripting (Persistent)…
CVE-2017-20057MEDIUMCVSS 4.3EG 6.1
2022-06-20
A vulnerability classified as problematic has been found in Elefant CMS 1.3.12-RC. Affected is an unknown function. The manipulation of the argument username leads to basic cross site scripting (Persistent). It is possible to launch the at…
CVE-2017-20033MEDIUMCVSS 4.3EG 6.1
2022-06-10
A vulnerability classified as problematic has been found in PHPList 3.2.6. This affects an unknown part of the file /lists/admin/. The manipulation of the argument page with the input send\'\";><script>alert(8)</script> leads to cross site…
CVE-2017-20027MEDIUMCVSS 4.3EG 6.1
2022-06-09
A vulnerability was found in HumHub up to 1.0.1 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting (DOM). The attack may be launched remotely. The exploit has…
CVE-2017-20026MEDIUMCVSS 4.3EG 6.1
2022-06-09
A vulnerability has been found in HumHub up to 1.0.1 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting (Reflected). The attack can be launched remotely…
CVE-2025-65924MEDIUMCVSS 4.1EG 6.1
2026-02-03
ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text. Although JavaScript is blocked (preventing XSS), the HTML is still preserved in the generated PDF …
CVE-2022-3844MEDIUMCVSS 3.5EG 6.1
2022-11-02
A vulnerability, which was classified as problematic, was found in Webmin 2.001. Affected is an unknown function of the file xterm/index.cgi. The manipulation leads to basic cross site scripting. It is possible to launch the attack remotel…
CVE-2017-20100MEDIUMCVSS 3.5EG 6.1
2022-06-27
A vulnerability was found in Air Transfer 1.0.14/1.2.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely. The …
CVE-2017-20097MEDIUMCVSS 3.5EG 6.1
2022-06-24
A vulnerability was found in WP-Filebase Download Manager Plugin 3.4.4. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launche…
CVE-2017-20096MEDIUMCVSS 3.5EG 6.1
2022-06-24
A vulnerability classified as problematic has been found in WP-SpamFree Anti-Spam Plugin 2.1.1.4. This affects an unknown part. The manipulation leads to basic cross site scripting. It is possible to initiate the attack remotely.
CVE-2017-20092MEDIUMCVSS 3.5EG 6.1
2022-06-24
A vulnerability classified as problematic was found in Google Analytics Dashboard Plugin 2.1.1. Affected by this vulnerability is an unknown functionality. The manipulation leads to basic cross site scripting. The attack can be launched re…
CVE-2017-20089MEDIUMCVSS 3.5EG 6.1
2022-06-23
A vulnerability was found in Gwolle Guestbook Plugin 1.7.4. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to basic cross site scripting. The attack may be initiated remotely.
CVE-2017-20087MEDIUMCVSS 3.5EG 6.1
2022-06-23
A vulnerability, which was classified as problematic, has been found in Alpine PhotoTile for Instagram Plugin 1.2.7.7. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack m…

Map vulnerabilities like CWE-80 to your infrastructure

EchelonGraph correlates every CVE — across CWE-80 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →