QooxDoo XSS in Callback Parameter
Moderate severity
GitHub Reviewed
Published
May 17, 2022
to the GitHub Advisory Database
•
Updated Jan 19, 2024
Description
Published by the National Vulnerability Database
Apr 18, 2011
Published to the GitHub Advisory Database
May 17, 2022
Reviewed
Jan 19, 2024
Last updated
Jan 19, 2024
Cross-site scripting (XSS) vulnerability in
framework/source/resource/qx/test/jsonp_primitive.php
in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or HTML via the callback parameter.References