Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).
CVE-2020-7656
Severity
6.1MEDIUM
EPSS
1.1%
top 21.91%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedMay 19
Latest updateApr 8
Description
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "" HTML tags that contain a whitespace character, i.e: "", which results in the enclosed script logic to be executed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7
Affected Packages9 packages
🔴Vulnerability Details
4💥Exploits & PoCs
1📋Vendor Advisories
2💬Community
20Bugzilla
▶
Bugzilla▶
CVE-2020-7656 python-XStatic-jQuery: jquery: Cross-site scripting (XSS) via <script> HTML tags containing whitespaces [epel-7]↗2020-06-23