ByteOS

Product

Fortinet FortiProxy

Versions

Affected

FortiOS version 7.0.3 and below, 6.4.8 and below, 6.2.10 and below, 6.0.14 to 6.0.0. FortiProxy version 7.0.1 and below, 2.0.7 to 2.0.0.

Problem Types

Type	CWE ID	Description
text	N/A	Unauthorized code execution

Type: text

CWE ID: N/A

Description: Unauthorized code execution

Metrics

Version	Base score	Base severity	Vector
3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:X/RL:W/RC:X

Version: 3.1

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:X/RL:W/RC:X

References

Hyperlink	Resource
https://fortiguard.com/psirt/FG-IR-21-230	x_refsource_CONFIRM

Hyperlink: https://fortiguard.com/psirt/FG-IR-21-230

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://fortiguard.com/psirt/FG-IR-21-230	x_refsource_CONFIRM x_transferred

Hyperlink: https://fortiguard.com/psirt/FG-IR-21-230

Resource:

x_refsource_CONFIRM

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:psirt@fortinet.com

Published At:11 May, 2022 | 15:15

Updated At:19 May, 2022 | 02:25

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Secondary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 3.1

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*

>>fortiproxy>>Versions from 2.0.0(inclusive) to 2.0.8(exclusive)

cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*

>>fortiproxy>>Versions from 7.0.0(inclusive) to 7.0.2(exclusive)

>>fortios>>Versions from 6.0.0(inclusive) to 6.0.14(inclusive)

>>fortios>>Versions from 6.2.0(inclusive) to 6.2.10(inclusive)

>>fortios>>Versions from 6.4.0(inclusive) to 6.4.9(exclusive)

>>fortios>>Versions from 7.0.0(inclusive) to 7.0.4(exclusive)

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://fortiguard.com/psirt/FG-IR-21-230	psirt@fortinet.com	Vendor Advisory

Hyperlink: https://fortiguard.com/psirt/FG-IR-21-230

Source: psirt@fortinet.com

Resource:

Vendor Advisory

Similar CVEs

17587Records found

CVE-2022-43952

Matching Score-6

Assigner-Fortinet, Inc.

Matching Score-6

Assigner-Fortinet, Inc.

CVSS Score-3.3||LOW

EPSS-0.25% / 48.05%

7 Day CHG~0.00%

Published-11 Apr, 2023 | 16:06

Updated-22 Oct, 2024 | 20:47

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC version 7.1.1 and below, version 7.0.3 and below, version 6.2.5 and below may allow an authenticated attacker to perform a cross-site scripting attack via crafted HTTP requests.

Vendor-Fortinet, Inc.

Product-fortiadc FortiADC

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-27780

Matching Score-6

Assigner-Fortinet, Inc.

Matching Score-6

Assigner-Fortinet, Inc.

CVSS Score-2.2||LOW

EPSS-0.03% / 5.19%

7 Day CHG~0.00%

Published-11 Feb, 2025 | 16:09

Updated-12 Feb, 2025 | 15:40

Multiple Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilities [CWE-79] in FortiSIEM 7.1 all versions, 7.0 all versions, 6.7 all versions incident page may allow an authenticated attacker to perform a cross-site scripting attack via crafted HTTP requests.

Vendor-Fortinet, Inc.

Product-FortiSIEM

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-41336

Matching Score-6

Assigner-Fortinet, Inc.

Matching Score-6

Assigner-Fortinet, Inc.

CVSS Score-6.6||MEDIUM

EPSS-0.10% / 28.98%

7 Day CHG~0.00%

Published-03 Jan, 2023 | 16:58

Updated-07 Nov, 2023 | 03:52

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiPortal versions 6.0.0 through 6.0.11 and all versions of 5.3, 5.2, 5.1, 5.0 management interface may allow a remote authenticated attacker to perform a stored cross site scripting (XSS) attack via sending request with specially crafted columnindex parameter.

Vendor-Fortinet, Inc.

Product-fortiportal FortiPortal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-40680

Matching Score-6

Assigner-Fortinet, Inc.

Matching Score-6

Assigner-Fortinet, Inc.

CVSS Score-3.8||LOW

EPSS-0.29% / 52.12%

7 Day CHG~0.00%

Published-06 Dec, 2022 | 16:00

Updated-07 Nov, 2023 | 03:52

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and 7.0.0 - 7.0.3 allows a privileged attacker to execute unauthorized code or commands via storing malicious payloads in replacement messages.

Vendor-Fortinet, Inc.

Product-fortios FortiOS FortiProxy

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-40676

Matching Score-6

Assigner-Fortinet, Inc.

Matching Score-6

Assigner-Fortinet, Inc.

CVSS Score-7.1||HIGH

EPSS-0.99% / 75.92%

7 Day CHG~0.00%

Published-07 Mar, 2023 | 16:04

Updated-23 Oct, 2024 | 14:31

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 allows attacker to execute unauthorized code or commands via specially crafted http requests.

Vendor-Fortinet, Inc.

Product-fortinac FortiNAC

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-32597

Matching Score-6

Assigner-Fortinet, Inc.

Matching Score-6

Assigner-Fortinet, Inc.

CVSS Score-4.6||MEDIUM

EPSS-0.17% / 38.67%

7 Day CHG~0.00%

Published-06 Aug, 2021 | 10:48

Updated-25 Oct, 2024 | 13:51

Multiple improper neutralization of input during web page generation (CWE-79) in FortiManager and FortiAnalyzer versions 7.0.0, 6.4.5 and below, 6.2.7 and below user interface, may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack (XSS) by injecting malicious payload in GET parameters.

Vendor-Fortinet, Inc.

Product-fortianalyzer fortimanager Fortinet FortiAnalyzer, FortiManager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-39950

Matching Score-6

Assigner-Fortinet, Inc.

Matching Score-6

Assigner-Fortinet, Inc.

CVSS Score-8||HIGH

EPSS-0.61% / 68.94%

7 Day CHG+0.01%

Published-02 Nov, 2022 | 00:00

Updated-25 Oct, 2024 | 13:17

An improper neutralization of input during web page generation vulnerability [CWE-79] exists in FortiManager and FortiAnalyzer 6.0.0 all versions, 6.2.0 all versions, 6.4.0 through 6.4.8, and 7.0.0 through 7.0.4. Report templates may allow a low privilege level attacker to perform an XSS attack via posting a crafted CKeditor "protected" comment as described in CVE-2020-9281.

Vendor-Fortinet, Inc.

Product-fortianalyzer fortimanager Fortinet FortiAnalyzer, FortiManager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-22855

Matching Score-6

Assigner-Fortinet, Inc.

Matching Score-6

Assigner-Fortinet, Inc.

CVSS Score-2.6||LOW

EPSS-0.05% / 16.60%

7 Day CHG~0.00%

Published-08 Apr, 2025 | 14:02

Updated-23 Jul, 2025 | 16:03

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Fortinet FortiClient before 7.4.1 may allow the EMS administrator to send messages containing javascript code.

Vendor-Fortinet, Inc.

Product-forticlientems FortiClientEMS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-38373

Matching Score-6

Assigner-Fortinet, Inc.

Matching Score-6

Assigner-Fortinet, Inc.

CVSS Score-8||HIGH

EPSS-0.92% / 75.04%

7 Day CHG+0.01%

Published-02 Nov, 2022 | 00:00

Updated-25 Oct, 2024 | 13:20

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiDeceptor management interface 4.2.0, 4.1.0 through 4.1.1, 4.0.2 may allow an authenticated user to perform a cross site scripting (XSS) attack via sending requests with specially crafted lure resource ID.

Vendor-Fortinet, Inc.

Product-fortideceptor Fortinet FortiDeceptor

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-24021

Matching Score-6

Assigner-Fortinet, Inc.

Matching Score-6

Assigner-Fortinet, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.19% / 40.67%

7 Day CHG~0.00%

Published-06 Oct, 2021 | 09:45

Updated-25 Oct, 2024 | 13:48

An improper neutralization of input vulnerability [CWE-79] in FortiAnalyzer versions 6.4.3 and below, 6.2.7 and below and 6.0.10 and below may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the column settings of Logview in FortiAnalyzer, should the attacker be able to obtain that POST request, via other, hypothetical attacks.

Vendor-Fortinet, Inc.

Product-fortianalyzer Fortinet FortiAnalyzer

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-52967

Matching Score-6

Assigner-Fortinet, Inc.

Matching Score-6

Assigner-Fortinet, Inc.

CVSS Score-3.3||LOW

EPSS-0.06% / 18.97%

7 Day CHG~0.00%

Published-14 Jan, 2025 | 14:09

Updated-03 Feb, 2025 | 21:59

An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiPortal 6.0.0 through 6.0.14 allows attacker to execute unauthorized code or commands via html injection.

Vendor-Fortinet, Inc.

Product-fortiportal FortiPortal

CWE ID-CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-26006

Matching Score-6

Assigner-Fortinet, Inc.

Matching Score-6

Assigner-Fortinet, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.49% / 64.47%

7 Day CHG~0.00%

Published-14 Mar, 2025 | 09:24

Updated-15 Mar, 2025 | 03:55

An improper neutralization of input during web page Generation vulnerability [CWE-79] in FortiOS version 7.4.3 and below, version 7.2.7 and below, version 7.0.13 and below and FortiProxy version 7.4.3 and below, version 7.2.9 and below, version 7.0.16 and below web SSL VPN UI may allow a remote unauthenticated attacker to perform a Cross-Site Scripting attack via a malicious samba server.

Vendor-Fortinet, Inc.

Product-FortiProxy FortiOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-31488

Matching Score-6

Assigner-Fortinet, Inc.

Matching Score-6

Assigner-Fortinet, Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.35% / 56.79%

7 Day CHG~0.00%

Published-14 May, 2024 | 16:19

Updated-21 Jan, 2025 | 21:47

An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0 through 7.2.3 may allow a remote authenticated attacker to perform stored and reflected cross site scripting (XSS) attack via crafted HTTP requests.

Vendor-Fortinet, Inc.

Product-fortinac FortiNAC fortinac

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-3612

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.28% / 51.31%

7 Day CHG~0.00%

Published-04 Feb, 2020 | 19:21

Updated-06 Aug, 2024 | 05:47

A Cross-site Scripting (XSS) vulnerability exists in FortiManager 5.2.1 and earlier and 5.0.10 and earlier via an unspecified parameter in the FortiWeb auto update service page.

Vendor-n/a Fortinet, Inc.

Product-fortimanager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-27781

Matching Score-6

Assigner-Fortinet, Inc.

Matching Score-6

Assigner-Fortinet, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.16% / 37.70%

7 Day CHG+0.02%

Published-11 Feb, 2025 | 16:09

Updated-22 Jul, 2025 | 21:37

An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSandbox at least versions 4.4.0 through 4.4.4 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.4 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.7 allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP requests.

Vendor-Fortinet, Inc.

Product-fortisandbox FortiSandbox

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-23111

Matching Score-6

Assigner-Fortinet, Inc.

Matching Score-6

Assigner-Fortinet, Inc.

CVSS Score-6.2||MEDIUM

EPSS-0.14% / 34.31%

7 Day CHG~0.00%

Published-11 Jun, 2024 | 14:32

Updated-27 Aug, 2025 | 20:42

An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions reboot page may allow a remote privileged attacker with super-admin access to execute JavaScript code via crafted HTTP GET requests.

Vendor-Fortinet, Inc.

Product-fortiproxy fortios FortiOS FortiProxy fortios fortiproxy

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-38379

Matching Score-6

Assigner-Fortinet, Inc.

Matching Score-6

Assigner-Fortinet, Inc.

CVSS Score-3.4||LOW

EPSS-0.39% / 58.96%

7 Day CHG~0.00%

Published-06 Dec, 2022 | 16:00

Updated-07 Nov, 2023 | 03:50

Improper neutralization of input during web page generation [CWE-79] in FortiSOAR 7.0.0 through 7.0.3 and 7.2.0 may allow an authenticated attacker to inject HTML tags via input fields of various components within FortiSOAR.

Vendor-Fortinet, Inc.

Product-fortisoar FortiSOAR

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-48893

Matching Score-6

Assigner-Fortinet, Inc.

Matching Score-6

Assigner-Fortinet, Inc.

CVSS Score-6.4||MEDIUM

EPSS-0.08% / 24.26%

7 Day CHG~0.00%

Published-14 Jan, 2025 | 14:08

Updated-03 Feb, 2025 | 22:12

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSOAR 7.3.0 through 7.3.3, 7.2.1 through 7.2.2 may allow an authenticated attacker to perform a stored cross site scripting (XSS) attack via the creation of malicious playbook.

Vendor-Fortinet, Inc.

Product-fortisoar FortiSOAR

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-6646

Matching Score-6

Assigner-Fortinet, Inc.

Matching Score-6

Assigner-Fortinet, Inc.

CVSS Score-5.4||MEDIUM

EPSS-0.23% / 45.36%

7 Day CHG~0.00%

Published-17 Mar, 2020 | 12:49

Updated-25 Oct, 2024 | 14:02

An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Disclaimer Description of a Replacement Message.

Vendor-n/a Fortinet, Inc.

Product-fortiweb Fortinet FortiWeb

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-18886

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 47.17%

7 Day CHG~0.00%

Published-18 Jun, 2019 | 13:08

Updated-05 Aug, 2024 | 11:23

Helpy v2.1.0 has Stored XSS via the Ticket title.

Vendor-helpy.io n/a

Product-helpy n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1662

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.31% / 53.56%

7 Day CHG~0.00%

Published-10 Apr, 2011 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Translation Management module 6.x before 6.x-1.21 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-icanlocalize n/a The Drupal Association

Product-drupal translation_management n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-22811

Matching Score-4

Assigner-Schneider Electric

Matching Score-4

Assigner-Schneider Electric

CVSS Score-6.1||MEDIUM

EPSS-0.81% / 73.34%

7 Day CHG~0.00%

Published-28 Jan, 2022 | 19:09

Updated-03 Aug, 2024 | 18:51

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause script execution when the request of a privileged account accessing the vulnerable web page is intercepted. Affected Products: 1-Phase Uninterruptible Power Supply (UPS) using NMC2 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635J (NMC2 AOS V6.9.8 and earlier), 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 250/500 (SYPX) Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635J (NMC2 AOS V6.9.6 and earlier), 3-Phase Uninterruptible Power Supply (UPS) using NMC2 including Symmetra PX 48/96/100/160 kW UPS (PX2), Symmetra PX 20/40 kW UPS (SY3P), Gutor (SXW, GVX), and Galaxy (GVMTS, GVMSA, GVXTS, GVXSA, G7K, GFC, G9KCHU): AP9630/AP9630CH/AP9630J, AP9631/AP9631CH/AP9631J, AP9635/AP9635CH (NMC2 AOS V6.9.6 and earlier), 1-Phase Uninterruptible Power Supply (UPS) using NMC3 including Smart-UPS, Symmetra, and Galaxy 3500 with Network Management Card 3 (NMC3): AP9640/AP9640J, AP9641/AP9641J, AP9643/AP9643J (NMC3 AOS V1.4.2.1 and earlier), APC Rack Power Distribution Units (PDU) using NMC2 2G Metered/Switched Rack PDUs with embedded NMC2: AP84XX, AP86XX, AP88XX, AP89XX (NMC2 AOS V6.9.6 and earlier), APC Rack Power Distribution Units (PDU) using NMC3 2G Metered/Switched Rack PDUs with embedded NMC3: APDU99xx (NMC3 AOS V1.4.0 and earlier), APC 3-Phase Power Distribution Products using NMC2 Galaxy RPP: GRPPIP2X84 (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 (NMC2) for InfraStruxure 150 kVA PDU with 84 Poles (X84P): PDPB150G6F (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for InfraStruxure 40/60kVA PDU (XPDU) PD40G6FK1-M, PD40F6FK1-M, PD40L6FK1-M, PDRPPNX10 M,PD60G6FK1, PD60F6FK1, PD60L6FK1, PDRPPNX10, PD40E5EK20-M, PD40H5EK20-M (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for Modular 150/175kVA PDU (XRDP): PDPM150G6F, PDPM150L6F, PDPM175G6H (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for 400 and 500 kVA (PMM): PMM400-ALA, PMM400-ALAX, PMM400-CUB, PMM500-ALA, PMM500-ALAX, PMM500-CUB (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 for Modular PDU (XRDP2G): PDPM72F-5U, PDPM138H-5U, PDPM144F, PDPM138H-R, PDPM277H, PDPM288G6H (NMC2 AOS V6.9.6 and earlier), Rack Automatic Transfer Switches (ATS) Embedded NMC2: Rack Automatic Transfer Switches - AP44XX (ATS4G) (NMC2 AOS V6.9.6 and earlier), Network Management Card 2 (NMC2) Cooling Products: InRow Cooling for series ACRP5xx, ACRP1xx, ACRD5xx, and ACRC5xx SKUs (ACRP2G), InRow Cooling for series ACRC10x SKUs (RC10X2G), InRow Cooling for series ACRD6xx and ACRC6xx SKUs (ACRD2G), InRow Cooling Display for series ACRD3xx (ACRC2G), InRow Cooling for series ACSC1xx SKUs (SC2G), InRow Cooling for series ACRD1xx and ACRD2xx (ACRPTK2G), Ecoflair IAEC25/50 Air Economizer Display (EB2G), Uniflair SP UCF0481I, UCF0341I (UNFLRSP), Uniflair LE DX Perimeter Cooling Display for SKUs: IDAV, IDEV, IDWV, IUAV, IUEV, IUWV, IXAV, IXEV, IXWV, LDAV, LDEV, and LDWV (LEDX2G), Refrigerant Distribution Unit: ACDA9xx (RDU) (NMC2 AOS V6.9.6 and earlier), Environmental Monitoring Unit with embedded NMC2 (NB250): NetBotz NBRK0250 (NMC2 AOS V6.9.6 and earlier), and Network Management Card 2 (NMC2): AP9922 Battery Management System (BM4) (NMC2 AOS V6.9.6 and earlier)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1332

Matching Score-4

Assigner-JPCERT/CC

Matching Score-4

Assigner-JPCERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.30% / 52.55%

7 Day CHG~0.00%

Published-29 Jun, 2011 | 17:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2008-6570.

Vendor-n/a Cybozu, Inc.

Product-garoon n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-13508

Matching Score-4

Assigner-Wordfence

Matching Score-4

Assigner-Wordfence

CVSS Score-6.1||MEDIUM

EPSS-0.13% / 32.83%

7 Day CHG~0.00%

Published-18 Feb, 2025 | 23:22

Updated-19 Feb, 2025 | 15:00

Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter

The Booking Package plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the locale parameter in all versions up to, and including, 1.6.72 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Vendor-masaakitanaka

Product-Booking Package

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1062

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.17% / 77.78%

7 Day CHG~0.00%

Published-22 Feb, 2011 | 23:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in include/html/header.php in TaskFreak! 0.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) sContext, (2) sort, (3) dir, and (4) show parameters in a save action to index.php; the (5) dir and (6) show parameters to print_list.php; and the (7) HTTP referer header to rss.php. NOTE: some of these details are obtained from third party information.

Vendor-taskfreak n/a

Product-taskfreak\!n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-12408

Matching Score-4

Assigner-Wordfence

Matching Score-4

Assigner-Wordfence

CVSS Score-6.1||MEDIUM

EPSS-0.14% / 35.09%

7 Day CHG+0.01%

Published-21 Dec, 2024 | 09:23

Updated-28 Dec, 2024 | 00:49

WP on AWS <= 5.2.1 - Reflected Cross-Site Scripting

The WP on AWS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_POST data in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Vendor-wpseahorse

Product-WP on AWS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-12873

Matching Score-4

Assigner-WPScan

Matching Score-4

Assigner-WPScan

CVSS Score-6.1||MEDIUM

EPSS-0.04% / 11.86%

7 Day CHG~0.00%

Published-15 May, 2025 | 20:06

Updated-09 Jun, 2025 | 19:57

Custom Field Manager <= 1.0 - Reflected XSS Vulnerability

The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Vendor-f1logic Unknown

Product-custom_field_manager Custom Field Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1716

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.50% / 65.07%

7 Day CHG~0.00%

Published-18 Apr, 2011 | 18:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in the Web UI in Xymon before 4.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-xymon n/a

Product-xymon n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1518

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.60% / 68.62%

7 Day CHG~0.00%

Published-18 Apr, 2011 | 18:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.4.x before 2.4.10 and 3.x before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a OTRS AG

Product-otrs n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-5242

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.48% / 64.12%

7 Day CHG~0.00%

Published-22 Aug, 2014 | 17:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value.

Vendor-n/a Wikimedia Foundation

Product-mediawiki n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-25064

Matching Score-4

Assigner-VulDB

Matching Score-4

Assigner-VulDB

CVSS Score-3.5||LOW

EPSS-0.06% / 17.39%

7 Day CHG~0.00%

Published-05 Jan, 2023 | 08:06

Updated-05 Aug, 2024 | 12:26

OSM Lab show-me-the-way site.js cross site scripting

A vulnerability was found in OSM Lab show-me-the-way. It has been rated as problematic. This issue affects some unknown processing of the file js/site.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. The patch is named 4bed3b34dcc01fe6661f39c0e5d2285b340f7cac. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217439.

Vendor-show-me-the-way_project OSM Lab

Product-show-me-the-way show-me-the-way

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-20685

Matching Score-4

Assigner-JPCERT/CC

Matching Score-4

Assigner-JPCERT/CC

CVSS Score-6.1||MEDIUM

EPSS-0.21% / 42.76%

7 Day CHG~0.00%

Published-07 Apr, 2021 | 07:15

Updated-03 Aug, 2024 | 17:45

Cross-site scripting vulnerability in Kagemai 0.8.8 allows remote attackers to inject an arbitrary script via unspecified vectors.

Vendor-daifukuya daifukuya.com

Product-kagemai Kagemai

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-22223

Matching Score-4

Assigner-GitLab Inc.

Matching Score-4

Assigner-GitLab Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.18% / 40.46%

7 Day CHG~0.00%

Published-06 Jul, 2021 | 21:50

Updated-03 Aug, 2024 | 18:37

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link

Vendor-GitLab Inc.

Product-gitlab GitLab

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1069

Matching Score-4

Assigner-Red Hat, Inc.

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 47.17%

7 Day CHG~0.00%

Published-05 Feb, 2020 | 20:45

Updated-06 Aug, 2024 | 22:14

PHPShop through 0.8.1 has XSS.

Vendor-phpshop PHPShop

Product-phpshop PHPShop

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-13015

Matching Score-4

Assigner-VulDB

Matching Score-4

Assigner-VulDB

CVSS Score-5.1||MEDIUM

EPSS-0.06% / 18.96%

7 Day CHG~0.00%

Published-29 Dec, 2024 | 15:31

Updated-18 Feb, 2025 | 19:13

PHPGurukul Maid Hiring Management System search-booking-request.php cross site scripting

A vulnerability was found in PHPGurukul Maid Hiring Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/search-booking-request.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be launched remotely.

Vendor-PHPGurukul LLP

Product-maid_hiring_management_system Maid Hiring Management System

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2011-1533

Matching Score-4

Assigner-HP Inc.

Product-photosmart_premium_c510 photosmart_d110 photosmart_premium_fax_all-in-one photosmart_premium_c310 photosmart_plus_b210 photosmart_b110 envy_100_d410 n/a

Matching Score-4

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.78% / 72.83%

7 Day CHG~0.00%

Published-15 Apr, 2011 | 00:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability on the HP Photosmart D110 and B110; Photosmart Plus B210; Photosmart Premium C310, Fax All-in-One, and C510; and ENVY 100 D410 printers allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-18208

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 47.17%

7 Day CHG~0.00%

Published-10 Oct, 2018 | 15:00

Updated-05 Aug, 2024 | 11:01

Virtualmin 6.03 allows XSS via the query string, as demonstrated by the webmin_search.cgi URI.

Vendor-virtualmin n/a

Product-virtualmin n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1524

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-14.62% / 94.22%

7 Day CHG~0.00%

Published-28 Mar, 2011 | 18:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the management login GUI page in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different vulnerability than CVE-2011-0545.

Vendor-n/a Symantec Corporation

Product-liveupdate_administrator n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1396

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.29% / 52.40%

7 Day CHG~0.00%

Published-13 Mar, 2012 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote attackers to inject arbitrary web script or HTML via the reportType parameter to an unspecified component.

Vendor-n/a IBM Corporation

Product-maximo_asset_management maximo_asset_management_essentials n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-20222

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.33% / 55.11%

7 Day CHG~0.00%

Published-02 Jan, 2020 | 04:30

Updated-05 Aug, 2024 | 02:39

In Support Incident Tracker (SiT!) 3.67, the Short Application Name and Application Name inputs in the config.php page are affected by XSS.

Vendor-sitracker n/a

Product-support_incident_tracker n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-8910

Matching Score-4

Assigner-TWCERT/CC

Matching Score-4

Assigner-TWCERT/CC

CVSS Score-5.3||MEDIUM

EPSS-0.05% / 13.73%

7 Day CHG~0.00%

Published-13 Aug, 2025 | 09:06

Updated-21 Aug, 2025 | 00:33

WellChoose｜Organization Portal System - Reflected Cross-site Scripting

Organization Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.

Vendor-wellchoose WellChoose

Product-organization_portal_system Organization Portal System

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-13220

Matching Score-4

Assigner-WPScan

Matching Score-4

Assigner-WPScan

CVSS Score-6.1||MEDIUM

EPSS-0.01% / 0.86%

7 Day CHG~0.00%

Published-31 Jan, 2025 | 06:00

Updated-20 Mar, 2025 | 15:15

Google Map Professional <= 1.0 - Reflected XSS

The WordPress Google Map Professional (Map In Your Language) WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Vendor-Unknown

Product-WordPress Google Map Professional (Map In Your Language)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1510

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 55.24%

7 Day CHG~0.00%

Published-20 Sep, 2011 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus (SDP) before 8012 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter.

Vendor-n/a ManageEngine (Zoho Corporation Pvt. Ltd.)

Product-servicedesk_plus n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-20928

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.31% / 53.82%

7 Day CHG~0.00%

Published-01 Aug, 2019 | 15:46

Updated-05 Aug, 2024 | 12:12

cPanel before 70.0.23 allows stored XSS via the cpaddons vendor interface (SEC-391).

Vendor-n/a cPanel (WebPros International, LLC)

Product-cpanel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-2464

Matching Score-4

Assigner-SAP SE

Matching Score-4

Assigner-SAP SE

CVSS Score-6.1||MEDIUM

EPSS-0.42% / 60.95%

7 Day CHG~0.00%

Published-11 Sep, 2018 | 15:00

Updated-05 Aug, 2024 | 04:21

SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability.

Vendor-SAP SE

Product-netweaver SAP WebDynpro

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-20525

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.47% / 63.65%

7 Day CHG~0.00%

Published-19 Mar, 2020 | 17:56

Updated-05 Aug, 2024 | 02:46

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.

Vendor-igniterealtime n/a

Product-openfire n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-25056

Matching Score-4

Assigner-VulDB

Matching Score-4

Assigner-VulDB

CVSS Score-3.5||LOW

EPSS-0.06% / 19.70%

7 Day CHG~0.00%

Published-28 Dec, 2022 | 11:32

Updated-17 May, 2024 | 01:27

yolapi metadata.py render_description cross site scripting

A vulnerability, which was classified as problematic, was found in yolapi. Affected is the function render_description of the file yolapi/pypi/metadata.py. The manipulation of the argument text leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is a0fe129055a99f429133a5c40cb13b44611ff796. It is recommended to apply a patch to fix this issue. VDB-216966 is the identifier assigned to this vulnerability.

Vendor-yola n/a

Product-yolapi yolapi

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-13218

Matching Score-4

Assigner-WPScan

Matching Score-4

Assigner-WPScan

CVSS Score-6.1||MEDIUM

EPSS-0.01% / 0.86%

7 Day CHG~0.00%

Published-31 Jan, 2025 | 06:00

Updated-14 Mar, 2025 | 17:15

Fast Tube <= 2.3.1 - Reflected XSS

The Fast Tube WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Vendor-Unknown

Product-Fast Tube

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-13219

Matching Score-4

Assigner-WPScan

Matching Score-4

Assigner-WPScan

CVSS Score-6.1||MEDIUM

EPSS-0.01% / 0.86%

7 Day CHG~0.00%

Published-31 Jan, 2025 | 06:00

Updated-31 Jan, 2025 | 16:15

Policy Genius <= 2.0.4 - Reflected XSS

The Privacy Policy Genius WordPress plugin through 2.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Vendor-Unknown

Product-Privacy Policy Genius

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-22157

Matching Score-4

Assigner-MITRE Corporation