# Cross-site scripting

A web page includes attacker-controlled script, which then runs in other people's browsers with their session and permissions.

How to fix: Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix.


- [CVE-2022-42948](https://insights.sbomify.com/CVE-2022-42948/): Fortra Cobalt Strike User Interface Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2024-42009](https://insights.sbomify.com/CVE-2024-42009/): RoundCube Webmail Cross-Site Scripting (critical 9.3, exploited in the wild)
- [CVE-2023-34192](https://insights.sbomify.com/CVE-2023-34192/): Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) (critical 9.0, exploited in the wild)
- [CVE-2019-18426](https://insights.sbomify.com/CVE-2019-18426/): WhatsApp Cross-Site Scripting (high 8.2, exploited in the wild)
- [CVE-2026-42897](https://insights.sbomify.com/CVE-2026-42897/): Microsoft Exchange Server Cross-Site Scripting (high 8.1, exploited in the wild)
- [CVE-2018-19943](https://insights.sbomify.com/CVE-2018-19943/): QNAP NAS File Station Cross-Site Scripting (high 8.0, exploited in the wild)
- [CVE-2025-66376](https://insights.sbomify.com/CVE-2025-66376/): Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (high 7.2, exploited in the wild)
- [CVE-2025-68461](https://insights.sbomify.com/CVE-2025-68461/): RoundCube Webmail Cross-site Scripting (high 7.2, exploited in the wild)
- [CVE-2020-11023](https://insights.sbomify.com/CVE-2020-11023/): JQuery Cross-Site Scripting (XSS) (medium 6.9, exploited in the wild)
- [CVE-2024-43573](https://insights.sbomify.com/CVE-2024-43573/): Microsoft Windows MSHTML Platform Spoofing (medium 6.5, exploited in the wild)
- [CVE-2024-44309](https://insights.sbomify.com/CVE-2024-44309/): Apple Multiple Products Cross-Site Scripting (XSS) (medium 6.3, exploited in the wild)
- [CVE-2020-13965](https://insights.sbomify.com/CVE-2020-13965/): Roundcube Webmail Cross-Site Scripting (XSS) (medium 6.3, exploited in the wild)

---
From sbomify Insights: https://insights.sbomify.com/types/xss/