admin/cve
1
0
Fork 0
mirror of https://github.com/0xMarcio/cve.git synced 2025-05-06 02:31:38 +00:00
Code Issues Packages Projects Releases Wiki Activity
cve/2016/CVE-2016-5394.md
0xMarcio c24be57ea5 Update CVE sources 2024-08-31 19:52
2024-08-31 19:52:39 +00:00

730 B
Raw Blame History

CVE-2016-5394

Description

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.

POC

Reference

No PoCs from references.

Github