← Vulnerability feed
Jquery Jquery
Agile Product Lifecycle Management For Process Oracle
Banking Platform Oracle
Business Process Management Suite Oracle
Communications Converged Application Server Oracle
Communications Interactive Session Recorder Oracle
Communications Services Gatekeeper Oracle
Communications Webrtc Session Controller Oracle
Endeca Information Discovery Studio Oracle
Enterprise Manager Ops Center Oracle
Enterprise Operations Monitor Oracle
Financial Services Analytical Applications Infrastructure Oracle
Financial Services Asset Liability Management Oracle
Financial Services Data Integration Hub Oracle
Financial Services Funds Transfer Pricing Oracle
Financial Services Hedge Management And Ifrs Valuations Oracle
Financial Services Liquidity Risk Management Oracle
Financial Services Loan Loss Forecasting And Provisioning Oracle
Financial Services Market Risk Measurement And Management Oracle
Financial Services Profitability Management Oracle
Financial Services Reconciliation Framework Oracle
Fusion Middleware Mapviewer Oracle
Healthcare Foundation Oracle
Healthcare Translational Research Oracle
Hospitality Cruise Fleet Management Oracle
Hospitality Guest Access Oracle
Hospitality Materials Control Oracle
Hospitality Reporting And Analytics Oracle
Insurance Insbridge Rating And Underwriting Oracle
Jd Edwards Enterpriseone Tools Oracle
Jdeveloper Oracle
Oss Support Tools Oracle
Peoplesoft Enterprise Peopletools Oracle
Primavera Gateway Oracle
Primavera Unifier Oracle
Real Time Scheduler Oracle
Retail Allocation Oracle
Retail Customer Insights Oracle
Retail Invoice Matching Oracle
Retail Sales Audit Oracle
Retail Workforce Management Software Oracle
Service Bus Oracle
Siebel Ui Framework Oracle
Utilities Framework Oracle
Utilities Mobile Workforce Management Oracle
Webcenter Sites Oracle
Weblogic Server Oracle
Start free
Open in platform
Vulnerability record · CVE-2015-9251 · published 18 January 2018
CVE-2015-9251: Jquery cross-site scripting vulnerability
Jquery · Jquery
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
6.1 CVSS 3.0 Medium EPSS 30% · top 1.9% CWE-79 · Cross-site scripting
6.1CVSS 3.0 base score, v2 4.3
30%EPSS exploitation probability, 30 days
NoNot in CISA KEV
47Affected product versions listed by NVD
76References
17 Jun 2026Last modified by NVD
Description
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
47 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
Jquery Jquery
Agile Product Lifecycle Management For Process Oracle
Banking Platform Oracle
Business Process Management Suite Oracle
Communications Converged Application Server Oracle
Communications Interactive Session Recorder Oracle
Communications Services Gatekeeper Oracle
Communications Webrtc Session Controller Oracle
Endeca Information Discovery Studio Oracle
Enterprise Manager Ops Center Oracle
Enterprise Operations Monitor Oracle
Financial Services Analytical Applications Infrastructure Oracle
Financial Services Asset Liability Management Oracle
Financial Services Data Integration Hub Oracle
Financial Services Funds Transfer Pricing Oracle
Financial Services Hedge Management And Ifrs Valuations Oracle
Financial Services Liquidity Risk Management Oracle
Financial Services Loan Loss Forecasting And Provisioning Oracle
Financial Services Market Risk Measurement And Management Oracle
Financial Services Profitability Management Oracle
Financial Services Reconciliation Framework Oracle
Fusion Middleware Mapviewer Oracle
Healthcare Foundation Oracle
Healthcare Translational Research Oracle
Hospitality Cruise Fleet Management Oracle
Hospitality Guest Access Oracle
Hospitality Materials Control Oracle
Hospitality Reporting And Analytics Oracle
Insurance Insbridge Rating And Underwriting Oracle
Jd Edwards Enterpriseone Tools Oracle
Jdeveloper Oracle
Oss Support Tools Oracle
Peoplesoft Enterprise Peopletools Oracle
Primavera Gateway Oracle
Primavera Unifier Oracle
Real Time Scheduler Oracle
Retail Allocation Oracle
Retail Customer Insights Oracle
Retail Invoice Matching Oracle
Retail Sales Audit Oracle
Retail Workforce Management Software Oracle
Service Bus Oracle
Siebel Ui Framework Oracle
Utilities Framework Oracle
Utilities Mobile Workforce Management Oracle
Webcenter Sites Oracle
Weblogic Server Oracle
References
Track CVE-2015-9251 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
9.8CVE-2019-2725Oracle WebLogic Server Web Services deserialization RCEOracle WebLogic Server's Web Services subcomponent contains an injection flaw (CWE-74) that allows unauthenticated remote code execution over HTTP. I…KEVEPSS 100%analysed6.1CVE-2020-11023jQuery DOM manipulation methods XSS via untrusted HTML option elementsjQuery versions 1.0.3 through before 3.5.0 execute untrusted code when HTML containing <option> elements from untrusted sources is passed to DOM mani…KEVEPSS 85%analysed10.0CVE-2018-14721Fasterxml jackson-databind server-side request forgery (ssrf) vulnerabilityFasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure …EPSS 10%9.9CVE-2026-60542Oracle business process management suite improper access control vulnerabilityVulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow). Supported versions tha…EPSS 0.43%9.9CVE-2021-21345XStream deserialization allows remote command executionXStream before 1.4.16 deserializes untrusted XML without adequate type restrictions, allowing code injection and OS command execution. The flaw is a …EPSS 72%analysed9.8CVE-2026-61183Oracle agile product lifecycle management for process improper authentication vulnerabilityVulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Reporting). The supported versi…EPSS 0.51%9.8CVE-2026-61178Oracle agile product lifecycle management for process improper authentication vulnerabilityVulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Installation). The supported ve…EPSS 0.51%9.8CVE-2026-21969Oracle agile product lifecycle management for process vulnerabilityVulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Supplier Portal). The supported…EPSS 0.48%
Source: NIST National Vulnerability Database (record CVE-2015-9251), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
