CWE-692

CVEs per yearBy the year they were published

1. 20231
2. 20242
3. 20253
4. 20265

Newest CVEs

• CVE-2026-107396

  Indico: Cross-Site-Scripting in link fields

  indico · indico

  Medium5.4
• CVE-2026-71478

  league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

  thephpleague · commonmark

  Medium6.1
• CVE-2024-23569

  HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header

  HCLSoftware · Aftermarket EPC

  Medium4.3
• CVE-2024-42214

  HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. The OPTIONS method provides a list of the methods that are…

  HCLSoftware · Aftermarket EPC

  Medium5.3
• CVE-2026-15295

  Ajax Load More <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

  dcooney · Ajax Load More – Infinite Scroll, Load More, & Lazy Load

  Medium4.4
• CVE-2025-20240

  A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site…

  Cisco · Cisco IOS XE Software

  Medium6.1
• CVE-2025-53904

  The Scratch Channel Has Potential Reflected Cross-Site Scripting (XSS) Vulnerability

  The-Scratch-Channel · the-scratch-channel.github.io

  Low1.3
• CVE-2025-49590

  CryptPad Dom-Based Cross-Site Scripting (XSS) Vulnerability

  cryptpad · cryptpad

  Low2.9
• CVE-2024-52305

  UnoPim Stored XSS : Cookie hijacking through Create User function

  unopim · unopim

  Medium6.5
• CVE-2024-30924

  Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the checkin.php component.

  Product not named

  Medium4.6

Vendors it comes up for most

1. HCLSoftware2
2. Cisco1
3. The-Scratch-Channel1
4. cryptpad1
5. dcooney1
6. indico1
7. kitabisa1
8. thephpleague1
9. unopim1