GHSA-pchf-755w-jj6v

Suggest an improvement
Source
https://github.com/advisories/GHSA-pchf-755w-jj6v
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pchf-755w-jj6v/GHSA-pchf-755w-jj6v.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-pchf-755w-jj6v
Aliases
  • CVE-2011-1714
Published
2022-05-17T01:59:37Z
Modified
2026-09-10T03:49:23Z
Summary
QooxDoo XSS in Callback Parameter
Details

Cross-site scripting (XSS) vulnerability in framework/source/resource/qx/test/jsonp_primitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or HTML via the callback parameter.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-19T17:22:09Z",
    "nvd_published_at": "2011-04-18T18:55:00Z",
    "severity": "MODERATE"
}
References

Affected packages

npm / qooxdoo

Package

Name
qooxdoo
View open source insights on deps.dev
Purl
pkg:npm/qooxdoo

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
1.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pchf-755w-jj6v/GHSA-pchf-755w-jj6v.json"