\", which results in the enclosed script logic to be executed. | RequestGuard","description":"jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove \"\", which results in the enclosed script logic to be executed.","url":"https://requestguard.com/vulnerabilities/cve/CVE-2020-7656/","image":{"@type":"ImageObject","url":"https://requestguard.com/images/marketing/og-image.png","alt":"jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove \"\", which results in the enclosed script logic to be executed."},"publisher":{"@type":"Organization","name":"RequestGuard","url":"https://requestguard.com"}} Skip to content
RequestGuard Vulnerabilities
Pricing

CVE record

CVE-2020-7656

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

CVE evidence

Known exploitation

Not listed in fetched KEV catalog

Absence from the fetched catalog does not establish that exploitation has not occurred.

Severity

moderate

CVSS 6.1 · CVSS_V3

Affected packages

2

Supported package records returned by OSV. Vendor and product names are not used to infer matches.

OSV package mapping

Affected open-source packages

PackageEcosystemFixed versions
jquerynpm1.9.0
org.webjars.npm:jquerymaven1.9.0