CWE-692
11 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 11Published CVEs11 of them scored
- 5Last 12 monthspublished in the last year
- 0Critical0 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-107396
Indico: Cross-Site-Scripting in link fields
indico · indico
Medium5.4 - CVE-2026-71478
league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
thephpleague · commonmark
Medium6.1 - CVE-2024-23569
HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header
HCLSoftware · Aftermarket EPC
Medium4.3 - CVE-2024-42214
HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. The OPTIONS method provides a list of the methods that are…
HCLSoftware · Aftermarket EPC
Medium5.3 - CVE-2026-15295
Ajax Load More <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
dcooney · Ajax Load More – Infinite Scroll, Load More, & Lazy Load
Medium4.4 - CVE-2025-20240
A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site…
Cisco · Cisco IOS XE Software
Medium6.1 - CVE-2025-53904
The Scratch Channel Has Potential Reflected Cross-Site Scripting (XSS) Vulnerability
The-Scratch-Channel · the-scratch-channel.github.io
Low1.3 - CVE-2025-49590
CryptPad Dom-Based Cross-Site Scripting (XSS) Vulnerability
cryptpad · cryptpad
Low2.9 - CVE-2024-52305
UnoPim Stored XSS : Cookie hijacking through Create User function
unopim · unopim
Medium6.5 - CVE-2024-30924
Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the checkin.php component.
Product not named
Medium4.6