vulnwire
6.1med

CVE-2016-10245

Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or if…

Published 7 y ago · modified 4 mo ago · JSON

CVSS
6.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.8%
percentile 79%
Public exploits
0
none known

Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection.

Exploit prediction (EPSS)

1.82% probability of exploitation in the next 30 days, higher than 79% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.06.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

  • bugzilla.gnome.org /show_bug.cgi?id=762934 · x_refsource_MISC, x_transferred
  • github.com /doxygen/doxygen/commit/1cc1adad2de03a0f013881b8960daf89aa155081 · x_refsource_MISC, x_transferred
  • stack.nl /~dimitri/doxygen/manual/changelog.html#log_1_8_12 · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/108476 · vdb-entry, x_refsource_BID, x_transferred
  • lists.debian.org /debian-lts-announce/2019/05/msg00046.html · mailing-list, x_refsource_MLIST, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2019-06/msg00000.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • usn.ubuntu.com /4002-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.