Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (45531 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-28975 1 Infoblox 1 Nios 2026-01-27 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in Infoblox NIOS v8.5.2-409296 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the VLAN View Name field.
CVE-2025-36409 1 Ibm 1 Applinx 2026-01-26 5.4 Medium
IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2025-36408 1 Ibm 1 Applinx 2026-01-26 6.4 Medium
IBM ApplinX 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2025-36396 1 Ibm 1 Application Gateway 2026-01-26 5.4 Medium
IBM Application Gateway 23.10 through 25.09 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2024-31975 1 Engeniustech 2 Ews356-fit, Ews356-fit Firmware 2026-01-26 4.8 Medium
EnGenius EWS356-Fit devices through 1.1.30 allow a remote attacker to conduct stored XSS attacks via the Wi-Fi SSID parameters. JavaScript embedded into a vulnerable field is executed when the user clicks the SSID field's corresponding EDIT button.
CVE-2024-51673 2 Hasthemes, Wordpress 2 Ht Politic, Wordpress 2026-01-26 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HasThemes HT Politic allows DOM-Based XSS.This issue affects HT Politic: from n/a through 2.4.4.
CVE-2024-41358 1 Phpipam 1 Phpipam 2026-01-26 6.1 Medium
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php.
CVE-2024-41349 1 Unmark 1 Unmark 2026-01-26 6.1 Medium
unmark 1.9.2 is vulnerable to Cross Site Scripting (XSS) via application/views/marks/add_by_url.php.
CVE-2024-41348 1 Jpatokal 1 Openflights 2026-01-26 6.1 Medium
openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/alsearch.php
CVE-2024-41347 1 Jpatokal 1 Openflights 2026-01-26 6.1 Medium
openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/settings.php
CVE-2024-41346 1 Jpatokal 1 Openflights 2026-01-26 6.1 Medium
openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/submit.php
CVE-2021-47769 1 Bdtask 1 Isshue 2026-01-26 4.8 Medium
Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules. Attackers with privileged user accounts can inject malicious scripts that execute on preview, potentially enabling session hijacking and persistent phishing attacks.
CVE-2025-8460 1 Centreon 2 Centreon, Open Tickets 2026-01-26 6.8 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Notification rules, Open tickets module) allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.5, from 23.10.0 before 23.10.4.
CVE-2025-12511 1 Centreon 2 Centreon, Dynamic Service Management 2026-01-26 6.8 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (DSM extenstio configuration modules) allows Stored XSS to user with elevated privileges. This issue affects Infra Monitoring: from 25.10.0 before 25.10.1, from 24.10.0 before 24.10.4, from 24.04.0 before 24.04.8.
CVE-2025-24752 2 Wordpress, Wpdeveloper 2 Wordpress, Essential Addons For Elementor 2026-01-26 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor allows Reflected XSS. This issue affects Essential Addons for Elementor: from n/a through 6.0.14.
CVE-2025-12746 2 Tainacan, Wordpress 2 Tainacan, Wordpress 2026-01-26 6.1 Medium
The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVE-2024-57277 2026-01-26 5.7 Medium
InnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting (XSS) via SVG file upload.
CVE-2024-41345 1 Jpatokal 1 Openflights 2026-01-26 6.1 Medium
openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/trip.php
CVE-2022-26573 1 Maccms 1 Maccms 2026-01-26 6.1 Medium
Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/art/data.html via the select and input parameters.
CVE-2025-12513 1 Centreon 2 Centreon, Centreon Web 2026-01-26 6.8 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts configuration form modules) allows Stored XSS to users with high privileges. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0 before 24.10.15, from 24.04.0 before 24.04.19.