Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2650)
CWE-79 (1914)
CWE-416 (1381)
CWE-862 (1239)
CWE-89 (1115)
CWE-22 (1042)
CWE-125 (937)
CWE-306 (861)
CWE-200 (860)
CWE-122 (833)
CWE-20 (805)
CWE-787 (733)
CWE-78 (723)
CWE-918 (703)
CWE-863 (664)
CWE-94 (651)
CWE-74 (604)
CWE-639 (574)
CWE-400 (541)
CWE-269 (508)
CWE-119 (505)
CWE-502 (485)
CWE-770 (450)
CWE-287 (448)
CWE-121 (414)
CWE-190 (381)
CWE-77 (377)
CWE-362 (376)
CWE-476 (309)
CWE-352 (289)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-55481 |
medium | 6.2 | 0.0032 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders header_ | |
CVE-2026-28315 |
medium | 6.2 | 0.0052 | 2026-07-21 | SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could | |
CVE-2026-18481 |
medium | 6.2 | 0.0051 | 2026-07-31 | Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might a | |
CVE-2023-0606 |
medium | 6.1 | 0.0064 | 2023-02-01 | Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7. | |
CVE-2023-24521 |
medium | 6.1 | 0.0039 | 2023-02-14 | Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 7 | |
CVE-2023-30741 |
medium | 6.1 | 0.0039 | 2023-05-09 | Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions | |
CVE-2023-30742 |
medium | 6.1 | 0.0044 | 2023-05-09 | SAP CRM (WebClient UI) - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, | |
CVE-2023-32070 |
medium | 6.1 | 0.0065 | 2023-05-10 | XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check f | 1 PoC |
CVE-2025-60934 |
medium | 6.1 | 0.0019 | 2025-10-21 | Multiple stored cross-site scripting (XSS) vulnerabilities in the index.php component of HR Performa | |
CVE-2025-61457 |
medium | 6.1 | 0.0032 | 2025-10-21 | code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField | |
CVE-2025-63448 |
medium | 6.1 | 0.0030 | 2025-11-03 | Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit_product.php?id=1. | |
CVE-2025-63418 |
medium | 6.1 | 0.0023 | 2025-11-05 | A DOM-based Cross-Site Scripting (XSS) vulnerability in the SelfBest platform 2023.3 allows attacker | |
CVE-2024-44635 |
medium | 6.1 | 0.0024 | 2025-11-14 | PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS) via adminname and | |
CVE-2024-44647 |
medium | 6.1 | 0.0024 | 2025-11-17 | PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via the aremark parameter in ma | |
CVE-2024-46334 |
medium | 6.1 | 0.0024 | 2025-11-17 | kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the formuser | |
CVE-2024-46336 |
medium | 6.1 | 0.0024 | 2025-11-17 | kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /client_user/ | |
CVE-2024-25814 |
medium | 6.1 | 0.0022 | 2025-12-22 | MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability vi | |
CVE-2024-35322 |
medium | 6.1 | 0.0022 | 2025-12-24 | MyNET up to v26.08 was discovered to contain a reflected cross-site scripting (XSS) vulnerability vi | |
CVE-2025-65136 |
medium | 6.1 | 0.0018 | 2026-04-14 | In manikandan580 School-management-system 1.0, a reflected XSS vulnerability exists in /studentms/ad | |
CVE-2024-13362 |
medium | 6.1 | 0.0028 | 2026-05-01 | Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via th | |
CVE-2023-42343 |
medium | 6.1 | 0.0059 | 2026-05-08 | A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type. | |
CVE-2023-42345 |
medium | 6.1 | 0.0015 | 2026-05-08 | A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp. | |
CVE-2024-34321 |
medium | 6.1 | 0.0019 | 2026-10-13 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) | |
CVE-2024-34326 |
medium | 6.1 | 0.0019 | 2026-10-13 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) | |
CVE-2026-113659 |
medium | 6.1 | 0.0034 | 2026-10-20 | ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticat | |
CVE-2024-5139 |
medium | 6.1 | 0.0023 | 2026-10-21 | The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for th | |
CVE-2026-114718 |
medium | 6.1 | 0.0024 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnera | |
CVE-2025-69723 |
medium | 6.1 | 0.0023 | 2026-10-22 | A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execut | |
CVE-2026-93638 |
medium | 6.1 | 0.0030 | 2026-10-23 | A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) | |
CVE-2026-105323 |
medium | 6.1 | 0.0018 | 2026-10-27 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-92098 |
medium | 6.1 | 0.0022 | 2026-10-28 | The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected | |
CVE-2026-101935 |
medium | 6.1 | 0.0025 | 2026-10-28 | The Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin for WordPress is vulnerabl | |
CVE-2026-118652 |
medium | 6.1 | 0.0024 | 2026-10-28 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatena | |
CVE-2026-11854 |
medium | 6.1 | 0.0021 | 2026-10-28 | The authentication endpoint generates an error message that includes reflected data directly from th | |
CVE-2026-61573 |
medium | 6.1 | 0.0025 | 2026-10-28 | AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request v | |
CVE-2026-58643 |
medium | 6.1 | 0.0041 | 2026-07-16 | Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admi | |
CVE-2021-25828 |
medium | 6.1 | 0.0053 | 2023-06-28 | Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a craf | |
CVE-2023-36386 |
medium | 6.1 | 0.0044 | 2023-07-11 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX | |
CVE-2023-23548 |
medium | 6.1 | 0.0041 | 2023-08-01 | Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30. | |
CVE-2025-6430 |
medium | 6.1 | 0.0027 | 2025-06-24 | When a file download is specified via the `Content-Disposition` header, that directive would be igno | |
CVE-2025-63499 |
medium | 6.1 | 0.0030 | 2025-12-04 | Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter. | |
CVE-2025-67443 |
medium | 6.1 | 0.0019 | 2025-12-22 | Schlix CMS before v2.2.9-5 is vulnerable to Cross Site Scripting (XSS). Due to lack of javascript sa | |
CVE-2026-0618 |
medium | 6.1 | 0.0018 | 2026-01-07 | Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell | |
CVE-2026-0670 |
medium | 6.1 | 0.0019 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab | |
CVE-2026-0671 |
medium | 6.1 | 0.0024 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab | |
CVE-2026-33883 |
medium | 6.1 | 0.0015 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and | |
CVE-2026-20085 |
medium | 6.1 | 0.0019 | 2026-04-01 | A vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, r | |
CVE-2026-33978 |
medium | 6.1 | 0.0029 | 2026-04-01 | Notesnook is a note-taking app focused on user privacy & ease of use. Prior to version 3.3.17, a sto | |
CVE-2026-33403 |
medium | 6.1 | 0.0019 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tra | |
CVE-2026-33404 |
medium | 6.1 | 0.0014 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tra |