CVE-2015-3296
CVE-2015-3296
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript: or (2) data: URLs.
CVSS 6.1 · Medium · EPSS 1.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
nodebb npm
- Affected ranges
- ECOSYSTEM: < 0.70
Update to 0.70
nodebb-plugin-markdown npm
- Affected ranges
- SEMVER: < 5.1.1
Update to 5.1.1