CWE-80— Improper Neutralization of Script-Related HTML Tags

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.— MITRE CWE catalog

703 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-80page 14 of 15

CVE-2024-34398MEDIUMCVSS 4.2EG 4.2
2025-03-12
An issue was discovered in BMC Remedy Mid Tier 7.6.04. The web application allows stored HTML Injection by authenticated remote attackers.
CVE-2024-47819MEDIUMCVSS 4.2EG 4.2
2024-10-22
Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. This can be leveraged to gain access to higher-privilege endpoints…
CVE-2025-31326MEDIUMCVSS 4.1EG 4.1
2025-07-08
SAP�BusinessObjects Business�Intelligence Platform (Web Intelligence) is vulnerable to HTML Injection, allowing an attacker with basic user privileges to inject malicious code into specific input fields. This could lead to unintended r…
CVE-2025-29430MEDIUMCVSS 4.1EG 4.1
2025-03-17
Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/room.php via the id and rome parameters.
CVE-2023-36555LOWCVSS 3.9EG 3.9
2023-10-10
An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components.
CVE-2023-33194LOWCVSS 3.7EG 3.7
2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn��…
CVE-2021-43862LOWCVSS 3.7EG 3.7
2021-12-30
jQuery Terminal Emulator is a plugin for creating command line interpreters in your applications. Versions prior to 2.31.1 contain a low impact and limited cross-site scripting (XSS) vulnerability. The code for XSS payload is always visibl…
CVE-2026-89290LOWCVSS 3.5EG 3.5
2026-10-08
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Stored XSS. This issue affects eimzamip: from v1.6.4 before v1.6.7.
CVE-2026-12812LOWCVSS 3.5EG 3.5
2026-06-22
A security vulnerability has been detected in Radware Cyber Controller up to 10.11.0. This affects an unknown part of the component HTML Report Generation. The manipulation leads to HTML injection. Remote exploitation of the attack is poss…
CVE-2026-11511LOWCVSS 3.5EG 3.5
2026-06-08
A weakness has been identified in Bolt CMS up to 3.7.5. This vulnerability affects unknown code of the file src/Storage/Field/Type/TextType.php of the component HTML Attribute Handler. Executing a manipulation of the argument style can lea…
CVE-2026-25764LOWCVSS 3.5EG 3.5
2026-02-06
OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an HTML injection vulnerability occurs in the time tracking function of OpenProject. The application does not escape HTML tags, an a…
CVE-2026-22254LOWCVSS 3.5EG 3.5
2026-02-06
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization…
CVE-2025-14186LOWCVSS 3.5EG 3.5
2025-12-07
A security flaw has been discovered in Grandstream GXP1625 1.0.7.4. The impacted element is an unknown function of the file /cgi-bin/api.values.post of the component Network Status Page. Performing manipulation of the argument vpn_ip resul…
CVE-2025-1807LOWCVSS 3.5EG 3.5
2025-03-02
A vulnerability, which was classified as problematic, was found in Eastnets PaymentSafe 2.5.26.0. This affects an unknown part of the file /directRouter.rfc of the component Edit Manual Reply Handler. The manipulation of the argument Title…
CVE-2024-52967LOWCVSS 3.5EG 3.5
2025-01-14
An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiPortal 6.0.0 through 6.0.14 allows attacker to execute unauthorized code or commands via html injection.
CVE-2024-47612LOWCVSS 3.5EG 3.5
2024-10-02
DataDump is a MediaWiki extension that provides dumps of wikis. Several interface messages are unescaped (more specifically, (datadump-table-column-queued), (datadump-table-column-in-progress), (datadump-table-column-completed), (datadump-…
CVE-2024-5851LOWCVSS 3.5EG 3.5
2024-06-11
A vulnerability classified as problematic has been found in playSMS up to 1.4.7. Affected is an unknown function of the file /index.php?app=main&inc=feature_schedule&op=list of the component SMS Schedule Handler. The manipulation of the ar…
CVE-2022-39372LOWCVSS 3.5EG 3.5
2022-11-03
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Authenticated users may store malicious cod…
CVE-2023-34354LOWCVSS 3.4EG 3.4
2023-10-11
A stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to execution of arbitrary javascript in another user's brow…
CVE-2026-41611LOWCVSS 3.3EG 3.3
2026-05-12
Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.
CVE-2025-29431LOWCVSS 3.2EG 3.2
2025-03-17
Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/department.php via the id, code, and name parameters.
CVE-2026-102279LOWCVSS 3.1EG 3.1
2026-09-28
Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scri…
CVE-2024-51472LOWCVSS 3.1EG 3.1
2025-01-06
IBM UrbanCode Deploy (UCD) 7.2 through 7.2.3.13, 7.3 through 7.3.2.8, and IBM DevOps Deploy 8.0 through 8.0.1.3 are vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially le…
CVE-2024-42195LOWCVSS 3.1EG 3.1
2024-12-05
HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.
CVE-2021-32719LOWCVSS 3.1EG 3.1
2021-06-28
RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the `rabbitmq_federation_management` plugin, its consumer tag was rendered wi…
CVE-2021-32718LOWCVSS 3.1EG 3.1
2021-06-28
RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `<script>` tag saniti…
CVE-2020-5283LOWCVSS 3.1EG 3.1
2020-04-03
ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository exposed by an other…
CVE-2026-27085LOWCVSS 2.7EG 2.7
2026-09-30
Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions.
CVE-2024-4214LOWCVSS 2.7EG 2.7
2024-05-17
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS vulnerability in Bill Minozzi Car Dealer allows Code Injection.This issue affects Car Dealer: from n/a through 4.15.
CVE-2024-24807LOWCVSS 2.7EG 2.7
2024-02-05
Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name. The HTML is executed when the tag name is listed in the auto complete form. Only…
CVE-2025-22402LOWCVSS 2.6EG 2.6
2025-02-07
Dell Update Manager Plugin, version(s) 1.5.0 through 1.6.0, contain(s) an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability. A low privileged attacker with remote access could potentially exploit t…
CVE-2024-8145LOWCVSS 2.4EG 2.4
2024-08-25
A vulnerability, which was classified as problematic, has been found in ClassCMS 4.8. Affected by this issue is some unknown functionality of the file /index.php/admin of the component Article Handler. The manipulation of the argument Titl…
CVE-2024-6251LOWCVSS 2.4EG 2.4
2024-06-22
A vulnerability, which was classified as problematic, was found in playSMS 1.4.3. Affected is an unknown function of the file /index.php?app=main&inc=feature_phonebook&op=phonebook_list of the component New Phonebook Handler. The manipulat…
CVE-2023-3017LOWCVSS 2.4EG 2.4
2023-05-31
A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been classified as problematic. This affects an unknown part of the file admin/?page=user/manage_user of the component Manage User Page. The manipula…
CVE-2020-4049LOWCVSS 2.4EG 2.4
2020-06-12
In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is …
CVE-2026-97711LOWCVSS 2.3EG 2.3
2026-09-29
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-clos…
CVE-2025-25299LOWCVSS 2.3EG 2.3
2025-02-20
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability af…
CVE-2026-112945LOWCVSS 2.1EG 2.1
2026-10-20
Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlF…
CVE-2026-57533LOWCVSS 2.1EG 2.1
2026-06-25
Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Policy, this can mainly be used for phishing purposes.
CVE-2026-57534LOWCVSS 2.1EG 2.1
2026-06-25
Malicious HTML content could be injected into the content of a page in the pretix-pages plugin.
CVE-2026-57535LOWCVSS 2.1EG 2.1
2026-06-25
Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these images pointed to an URL, the PDF rendering engine would download the image from that place and di…
CVE-2026-13314LOWCVSS 2.0EG 2.0
2026-06-25
Malicious HTML content could be injected into the content rendered by the pretix-digital plugin.
CVE-2025-22274LOWCVSS 2.0EG 2.0
2025-02-28
It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unkn…
CVE-2025-71310LOWCVSS 1.8EG 1.8
2026-05-26
The GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. This …
CVE-2026-103585LOWCVSS 1.2EG 1.2
2026-09-30
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki MediaSearch extension:…
CVE-2026-103445LOWCVSS 1.2EG 1.2
2026-09-30
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS. This issue affects MediaWiki Page_Forms extension: 1.46, 1.45, and 1…
CVE-2026-103584LOWCVSS 1.1EG 1.1
2026-09-30
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki CommonsMetadata ex…
CVE-2026-103437LOWCVSS 1.1EG 1.1
2026-09-30
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1…
CVE-2026-103444LOWCVSS 1.1EG 1.1
2026-09-30
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension allows Stored XSS. This issue affects MediaWiki WikiForum extension: master.
CVE-2026-103443LOWCVSS 1.1EG 1.1
2026-09-30
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book) extension allows XSS Targeting Non-Script Elements. This issue affects MediaWiki Collectio…

Map vulnerabilities like CWE-80 to your infrastructure

EchelonGraph correlates every CVE — across CWE-80 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →