CVE-2016-5394

—

CVSS 3.1

6.1 medium

EPSS

3%p84

Published

Jul 19, 2017 (Jul 19, 2017)

Modified

Jun 17, 2026

Description

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.

Vendors: apache
Products: sling
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (2.6%)

In the news0 stories

No ingested article mentions this CVE yet.