CVE-20XX-?
agent?

Server CVEs.

Published CVEs that affect server software, ranked by exploit odds.

582 CVEs · updated 2026-11-13 09:13 UTC

Reset all
  1. CVE-2006-3918

    http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.

    XSS Server Apache Http Server

    4.3 MEDIUM 95% exploit odds Fix listed
  2. CVE-2002-0840

    Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.

    XSS Server Apache Http Server

    6.8 MEDIUM 95% exploit odds Fix listed
  3. CVE-2019-10092

    In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.

    XSS Server Apache Http Server

    6.1 MEDIUM 81% exploit odds Fix listed
  4. CVE-2007-6388

    Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    XSS Server Apache Http Server

    4.3 MEDIUM 76% exploit odds Fix listed
  5. CVE-2005-3352

    Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.

    XSS Server Apache Http Server

    4.3 MEDIUM 74% exploit odds Fix listed
  6. CVE-2026-42897

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

    exploited XSS Server Microsoft Exchange Server

    8.1 HIGH 71% exploit odds Fix listed
  7. CVE-2025-30676

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.19. Users are recommended to upgrade to version 18.12.19, which fixes the issue.

    XSS Server Apache Ofbiz

    6.1 MEDIUM 68% exploit odds Fix listed
  8. CVE-2002-0148

    Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page.

    XSS Server Microsoft Internet Information Server

    7.5 HIGH 65% exploit odds No fix listed
  9. CVE-2025-5301

    ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.

    XSS Server

    6.1 MEDIUM 63% exploit odds No fix listed
  10. CVE-2024-1883

    This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. An attacker can exploit this weakness by crafting a malicious URL that contains a script. When an unsuspecting user clicks on this malicious link, it could potentially lead to limited loss of confidentiality, integrity or availability.

    XSS Server Papercut Mf

    6.3 MEDIUM 61% exploit odds Fix listed
  11. CVE-2004-2115

    Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.

    XSS Server Oracle Http Server

    6.8 MEDIUM 58% exploit odds No fix listed
  12. CVE-2014-1823

    Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2010 and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing a valid meeting ID, aka "Lync Server Content Sanitization Vulnerability."

    XSS Server Microsoft Lync Server

    4.3 MEDIUM 51% exploit odds Fix listed
  13. CVE-2019-17120

    A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/adm_usrs.jsp. The usr parameter is vulnerable: the reflected cross-site scripting occurs immediately after the user is created. The malicious script is stored and will be executed whenever /WiKIDAdmin/adm_usrs.jsp is visited.

    XSS Server Wikidsystems 2fa Enterprise Server

    6.1 MEDIUM 49% exploit odds No fix listed
  14. CVE-2007-5000

    Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    XSS Server Apache Http Server

    4.3 MEDIUM 47% exploit odds Fix listed
  15. CVE-2006-1193

    Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access (OWA), allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing."

    XSS Server Microsoft Exchange Server

    2.6 LOW 40% exploit odds Fix listed
  16. CVE-2002-1181

    Multiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to execute HTML script as other users through (1) a certain ASP file in the IISHELP virtual directory, or (2) possibly other unknown attack vectors.

    XSS Server Microsoft Internet Information Server

    6.8 MEDIUM 39% exploit odds Fix listed
  17. CVE-2002-0074

    Cross-site scripting vulnerability in Help File search facility for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's session.

    XSS Server Microsoft Internet Information Server

    7.5 HIGH 37% exploit odds No fix listed
  18. CVE-2002-0075

    Cross-site scripting vulnerability for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error message used in a URL redirect (""302 Object Moved") message.

    XSS Server Microsoft Internet Information Server

    7.5 HIGH 37% exploit odds No fix listed
  19. CVE-2024-11182

    An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.

    exploited XSS Server Mdaemon

    5.3 MEDIUM 33% exploit odds No fix listed
  20. CVE-2007-0220

    Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an "incorrectly handled UTF character set label".

    XSS Server Microsoft Exchange Server

    6.8 MEDIUM 33% exploit odds Fix listed
  21. CVE-2022-27665

    Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0. This can lead to execution of malicious code and commands on the client due to improper handling of user-provided input. By inputting malicious payloads in the subdirectory searchbar or Add folder filename boxes, it is possible to execute client-side commands. For example, there is Client-Side Template Injection via subFolderPath to the ThinClient/WtmApiService.asmx/GetFileSubTree URI.

    XSS Server Progress Ws Ftp Server

    6.1 MEDIUM 33% exploit odds Fix listed
  22. CVE-2002-1567

    Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.

    XSS Server Apache Tomcat

    6.8 MEDIUM 27% exploit odds Fix listed
  23. CVE-2008-2248

    Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified HTML, a different vulnerability than CVE-2008-2247.

    XSS Server Microsoft Exchange Server

    4.3 MEDIUM 25% exploit odds Fix listed
  24. CVE-2008-2247

    Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified e-mail fields, a different vulnerability than CVE-2008-2248.

    XSS Server Microsoft Exchange Server

    4.3 MEDIUM 25% exploit odds Fix listed
  25. CVE-2003-0002

    Cross-site scripting vulnerability (XSS) in ManualLogin.asp script for Microsoft Content Management Server (MCMS) 2001 allows remote attackers to execute arbitrary script via the REASONTXT parameter.

    XSS Server Microsoft Content Management Server

    6.8 MEDIUM 23% exploit odds Fix listed
  26. CVE-2012-3499

    Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules.

    XSS Server Apache Http Server

    4.3 MEDIUM 23% exploit odds Fix listed
  27. CVE-2009-0237

    Cross-site scripting (XSS) vulnerability in cookieauth.dll in the HTML forms authentication component in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2006, 2006 Supportability Update, and 2006 SP1; allows remote attackers to inject arbitrary web script or HTML via "authentication input" to this component, aka "Cross-Site Scripting Vulnerability."

    XSS Server Microsoft Forefront Threat Management Gateway

    4.3 MEDIUM 23% exploit odds No fix listed
  28. CVE-2003-0526

    Cross-site scripting (XSS) vulnerability in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to inject arbitrary web script via a URL containing the script in the domain name portion, which is not properly cleansed in the default error pages (1) 500.htm for "500 Internal Server error" or (2) 404.htm for "404 Not Found."

    XSS Server Microsoft Isa Server

    6.8 MEDIUM 22% exploit odds Fix listed
  29. CVE-2010-1257

    Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization.

    XSS Server Microsoft Office Infopath

    4.3 MEDIUM 22% exploit odds No fix listed
  30. CVE-2004-0203

    Cross-site scripting (XSS) vulnerability in Outlook Web Access for Exchange Server 5.5 Service Pack 4 allows remote attackers to insert arbitrary script and spoof content in HTML email or web caches via an HTML redirect query.

    XSS Server Microsoft Exchange Server

    4.3 MEDIUM 21% exploit odds Fix listed
  31. CVE-2005-3204

    Cross-site scripting (XSS) vulnerability in Oracle XML DB 9iR2 allows remote attackers to inject arbitrary web script or HTML via the query string in an HTTP request.

    XSS Server Oracle Application Server

    4.3 MEDIUM 21% exploit odds Fix listed
  32. CVE-2003-0712

    Cross-site scripting (XSS) vulnerability in the HTML encoding for the Compose New Message form in Microsoft Exchange Server 5.5 Outlook Web Access (OWA) allows remote attackers to execute arbitrary web script.

    XSS Server Microsoft Exchange Server

    4.3 MEDIUM 20% exploit odds Fix listed
  33. CVE-2003-0223

    Cross-site scripting vulnerability (XSS) in the ASP function responsible for redirection in Microsoft Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to embed a URL containing script in a redirection message.

    XSS Server Microsoft Internet Information Server

    6.8 MEDIUM 17% exploit odds No fix listed
  34. CVE-2012-1892

    Cross-site scripting (XSS) vulnerability in Microsoft Visual Studio Team Foundation Server 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "XSS Vulnerability."

    XSS Server Microsoft Visual Studio Team Foundation Server

    4.3 MEDIUM 17% exploit odds No fix listed
  35. CVE-2020-25385

    Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapshot_name parameter, which may impact users who open a maliciously crafted link or third-party web page.

    XSS Server Nagios Log Server

    6.1 MEDIUM 16% exploit odds No fix listed
  36. CVE-2012-2552

    Cross-site scripting (XSS) vulnerability in the SQL Server Report Manager in Microsoft SQL Server 2000 Reporting Services SP2 and SQL Server 2005 SP4, 2008 SP2 and SP3, 2008 R2 SP1, and 2012 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "Reflected XSS Vulnerability."

    XSS Server Microsoft Sql Server

    4.3 MEDIUM 16% exploit odds No fix listed
  37. CVE-2012-2536

    Cross-site scripting (XSS) vulnerability in Microsoft Systems Management Server 2003 SP3 and System Center Configuration Manager 2007 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Reflected XSS Vulnerability."

    XSS Server Microsoft System Center Configuration Manager

    4.3 MEDIUM 16% exploit odds No fix listed
  38. CVE-2020-8512

    In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.

    XSS Server Icewarp Server

    6.1 MEDIUM 15% exploit odds No fix listed
  39. CVE-2014-1820

    Cross-site scripting (XSS) vulnerability in Master Data Services (MDS) in Microsoft SQL Server 2012 SP1 and 2014 on 64-bit platforms allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "SQL Master Data Services XSS Vulnerability."

    XSS Server Microsoft Sql Server

    4.3 MEDIUM 15% exploit odds No fix listed
  40. CVE-2020-16157

    A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -> Email Users menu.

    XSS Server Nagios Log Server

    5.4 MEDIUM 14% exploit odds Fix listed
  41. CVE-2021-28359

    The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 https://nvd.nist.gov/vuln/detail/CVE-2021-23336).

    XSS Server Apache Airflow

    6.1 MEDIUM 14% exploit odds Fix listed
  42. CVE-2005-0563

    Cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA) component in Exchange Server 5.5 allows remote attackers to inject arbitrary web script or HTML via an email message with an encoded javascript: URL ("jav&#X41sc&#0010;ript:") in an IMG tag.

    XSS Server Microsoft Exchange Server

    4.3 MEDIUM 14% exploit odds Fix listed
  43. CVE-2001-0658

    Cross-site scripting (CSS) vulnerability in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause other clients to execute certain script or read cookies via malicious script in an invalid URL that is not properly quoted in an error message.

    XSS Server Microsoft Isa Server

    7.5 HIGH 14% exploit odds No fix listed
  44. CVE-2002-0187

    Cross-site scripting vulnerability in the SQLXML component of Microsoft SQL Server 2000 allows an attacker to execute arbitrary script via the root parameter as part of an XML SQL query, aka "Script Injection via XML Tag."

    XSS Server Microsoft Sql Server

    7.5 HIGH 14% exploit odds Fix listed
  45. CVE-2002-0682

    Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.

    XSS Server Apache Tomcat

    7.5 HIGH 14% exploit odds Fix listed
  46. CVE-2020-28903

    Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary HTML, aka XSS.

    XSS Server Nagios Fusion

    6.1 MEDIUM 13% exploit odds Fix listed
  47. CVE-2015-6061

    Cross-site scripting (XSS) vulnerability in Microsoft Skype for Business 2016, Lync 2010 and 2013 SP1, Lync 2010 Attendee, and Lync Room System allows remote attackers to inject arbitrary web script or HTML via an instant-message session, aka "Server Input Validation Information Disclosure Vulnerability."

    XSS Server Microsoft Lync

    4.3 MEDIUM 13% exploit odds No fix listed
  48. CVE-2020-17083

    Microsoft Exchange Server Remote Code Execution Vulnerability

    XSS Server Microsoft Exchange Server

    5.5 MEDIUM 12% exploit odds Fix listed
  49. CVE-2001-0829

    A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message.

    XSS Server Apache Tomcat

    5.1 MEDIUM 12% exploit odds Fix listed
  50. CVE-2015-1632

    Cross-site scripting (XSS) vulnerability in errorfe.aspx in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via the msgParam parameter in an authError action, aka "Exchange Error Message Cross Site Scripting Vulnerability."

    XSS Server Microsoft Exchange Server

    4.3 MEDIUM 12% exploit odds No fix listed

CVEs that affect server, sorted by how likely they are to be exploited (EPSS).