PoC Index85,079 CVEs with PoCs

CVE-2020-11023

Potential XSS vulnerability in jQuery

KEVMEDIUM 6.1EPSS 84.9%

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Affected
jquery · jQuery
CVSS v3.1 NVD
6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v3.1 GITHUB
6.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS v3.1 GitHub
6.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N/E:H
CVSS v2.0 NVD
4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS
84.89% chance of exploitation in the next 30 days, 100th percentile
CISA KEV
added 2025-01-23
Published
2020-04-29
Updated
2025-10-21

Proof-of-concept exploits (6)

ExploitDB entries (1)

Exploit collections (1)

Security advisories

References

Related