CVE-2015-3296

Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript: or (2) data: URLs.

Score

CVSS 3.0 6.1 Medium

Status

Modified - cve@mitre.org

Published

2017-09-21

Last modified

2024-08-06

Weaknesses

CWE-79

Affected products

• Nodebb (Nodebb)

References

• http://www.openwall.com/lists/oss-security/2015/04/10/10
• http://www.securityfocus.com/bid/71824
• https://github.com/julianlam/nodebb-plugin-markdown/commit/ab7f2684750882f7baefbfa31db8d5aac71e6ec3