Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:79"
1,853 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-47119 |
medium | 5.3 | 0.0024 | 2026-05-27 | Agent Zero before version 1.15 contains a stored cross-site scripting vulnerability that allows atta | |
CVE-2026-45014 |
medium | 5.3 | 0.0029 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29 | |
CVE-2026-12621 |
medium | 5.3 | 0.0023 | 2026-06-19 | Improper neutralization of input during web page generation XSS vulnerability in the GridTime 3000 | |
CVE-2026-56347 |
medium | 5.3 | 0.0020 | 2026-06-20 | AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in m | |
CVE-2026-56761 |
medium | 5.3 | 0.0029 | 2026-06-24 | hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allow | |
CVE-2026-58030 |
medium | 5.3 | 0.0027 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab | |
CVE-2026-58032 |
medium | 5.3 | 0.0030 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab | |
CVE-2026-59711 |
medium | 5.3 | 0.0023 | 2026-07-06 | showdown contains a cross-site scripting vulnerability in metadata title handling that allows attack | |
CVE-2026-59926 |
medium | 5.3 | 0.0033 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() | |
CVE-2026-15552 |
medium | 5.3 | 0.0034 | 2026-07-13 | Enterprise Cloud Database developed by Ragic has a Stored Cross-Site Scripting vulnerability, allowi | |
CVE-2026-61501 |
medium | 5.3 | 0.0042 | 2026-07-13 | Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sani | |
CVE-2026-49971 |
medium | 5.3 | 0.0036 | 2026-07-13 | Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authe | |
CVE-2026-58475 |
medium | 5.3 | 0.0031 | 2026-07-14 | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting | |
CVE-2026-63264 |
medium | 5.3 | 0.0044 | 2026-07-22 | Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3 - The Joomla extension | |
CVE-2026-64828 |
medium | 5.3 | 0.0037 | 2026-07-22 | Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows u | |
CVE-2026-65914 |
medium | 5.3 | 0.0031 | 2026-07-23 | DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into | |
CVE-2026-59232 |
medium | 5.3 | 0.0053 | 2026-07-31 | Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenti | |
CVE-2026-54216 |
medium | 5.3 | 0.0045 | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) | |
CVE-2026-69116 |
medium | 5.3 | 0.0034 | 2026-08-10 | FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vu | |
CVE-2026-73156 |
medium | 5.3 | 0.0044 | 2026-08-11 | Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Su | |
CVE-2026-18247 |
medium | 5.3 | 0.0044 | 2026-08-11 | A Cross Site Scripting (XSS) vulnerability in the Web Portals of AtHoc IWS in versions earlier than | |
CVE-2026-73422 |
medium | 5.3 | 0.0055 | 2026-08-12 | Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side Vi | |
CVE-2026-73628 |
medium | 5.3 | 0.0026 | 2026-08-13 | Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in | |
CVE-2026-67189 |
medium | 5.3 | 0.0117 | 2026-08-19 | pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnera | |
CVE-2026-77028 |
medium | 5.3 | 0.0041 | 2026-08-21 | Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parame | |
CVE-2026-77993 |
medium | 5.3 | 0.0044 | 2026-08-24 | Joomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.5 - The Joomla extension Pag | |
CVE-2026-90848 |
medium | 5.3 | 0.0047 | 2026-09-15 | A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function | |
CVE-2026-104083 |
medium | 5.3 | 0.0033 | 2026-10-09 | SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that all | |
CVE-2026-63169 |
medium | 5.3 | 0.0029 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that all | |
CVE-2026-113583 |
medium | 5.3 | 0.0039 | 2026-10-20 | Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allo | |
CVE-2026-114404 |
medium | 5.3 | 0.0026 | 2026-10-21 | PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer tha | |
CVE-2026-116203 |
medium | 5.3 | 0.0017 | 2026-10-25 | YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, | |
CVE-2026-116206 |
medium | 5.3 | 0.0016 | 2026-10-25 | YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows aut | |
CVE-2026-116217 |
medium | 5.3 | 0.0029 | 2026-10-26 | RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/Food_Ser | |
CVE-2026-66911 |
medium | 5.3 | — | 2026-10-29 | Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in em | |
CVE-2026-66912 |
medium | 5.3 | — | 2026-10-29 | Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML repl | |
CVE-2024-58296 |
medium | 5.3 | 0.0037 | 2025-12-11 | CE Phoenix v1.0.8.20 contains a stored cross-site scripting vulnerability in the currencies administ | |
CVE-2023-54349 |
medium | 5.1 | 0.0027 | 2026-05-05 | AmazCart CMS 3.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated | |
CVE-2026-40507 |
medium | 5.1 | 0.0034 | 2026-08-19 | OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal t | |
CVE-2026-40508 |
medium | 5.1 | 0.0030 | 2026-08-19 | OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal temp | |
CVE-2012-20005 |
medium | 5.1 | 0.0021 | 2026-10-20 | SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability | |
CVE-2014-125132 |
medium | 5.1 | 0.0021 | 2026-10-20 | Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerabili | |
CVE-2020-37284 |
medium | 5.1 | 0.0021 | 2026-10-22 | Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unau | |
CVE-2024-58394 |
medium | 5.1 | 0.0020 | 2026-10-22 | Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attac | |
CVE-2026-4951 |
medium | 5.1 | 0.0036 | 2026-10-23 | The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users | |
CVE-2026-4952 |
medium | 5.1 | 0.0028 | 2026-10-23 | The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows au | |
CVE-2025-58403 |
medium | 5.1 | 0.0050 | 2026-10-23 | CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of | |
CVE-2026-70382 |
medium | 5.1 | 0.0025 | 2026-10-26 | Some externally supplied values stored by the device may be rendered in the web interface without su | |
CVE-2026-116802 |
medium | 5.1 | 0.0022 | 2026-10-27 | DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypas | |
CVE-2026-116803 |
medium | 5.1 | 0.0016 | 2026-10-27 | DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep |