CVE-2011-1714 QooxDoo XSS in Callback Parameter
MediumCVSS 4.3
EPSS 2.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in framework/source/resource/qx/test/jsonp_primitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or HTML via the callback parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm qooxdoo(npm) | <= 1.3 | No fix listed |
| qooxdoo | = 1.3 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- eyeos-jsonpprimitive-xss(66574) vdb-entry
- 17127 exploit
- web.archive.org
- web.archive.org
- web.archive.org
- github.com
- blog.eyeos.org
- 71718 exploit vdb-entry
- 71720 vdb-entry
- 43818 third-party-advisory vendor-advisory
- 43997 third-party-advisory vendor-advisory
- www.autosectools.com exploit
- 47184 exploit vdb-entry