CVE-2015-9251

6.1 mediumEPSS 30%

Medium (6.1). EPSS 30% chance of exploitation in the next 30 days. Fixed in jquery 1.12.2, 3.0.0.

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Severity

CVSS 3.0

6.1 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 30% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2018-01-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jquery:jquery
oracle:agile_product_lifecycle_management_for_process
oracle:banking_platform
oracle:business_process_management_suite
oracle:communications_converged_application_server
oracle:communications_interactive_session_recorder
oracle:communications_services_gatekeeper
oracle:communications_webrtc_session_controller
oracle:endeca_information_discovery_studio
oracle:enterprise_manager_ops_center
oracle:enterprise_operations_monitor
oracle:financial_services_analytical_applications_infrastructure
oracle:financial_services_asset_liability_management
oracle:financial_services_data_integration_hub
oracle:financial_services_funds_transfer_pricing
oracle:financial_services_hedge_management_and_ifrs_valuations
oracle:financial_services_liquidity_risk_management
oracle:financial_services_loan_loss_forecasting_and_provisioning
oracle:financial_services_market_risk_measurement_and_management
oracle:financial_services_profitability_management
oracle:financial_services_reconciliation_framework
oracle:fusion_middleware_mapviewer
oracle:healthcare_foundation
oracle:healthcare_translational_research
oracle:hospitality_cruise_fleet_management
oracle:hospitality_guest_access
oracle:hospitality_materials_control
oracle:hospitality_reporting_and_analytics
oracle:insurance_insbridge_rating_and_underwriting
oracle:jd_edwards_enterpriseone_tools
oracle:jdeveloper
oracle:oss_support_tools
oracle:peoplesoft_enterprise_peopletools
oracle:primavera_gateway
oracle:primavera_unifier
oracle:real-time_scheduler
oracle:retail_allocation
oracle:retail_customer_insights
oracle:retail_invoice_matching
oracle:retail_sales_audit
oracle:retail_workforce_management_software
oracle:service_bus
oracle:siebel_ui_framework
oracle:utilities_framework
oracle:utilities_mobile_workforce_management
oracle:webcenter_sites
oracle:weblogic_server

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-rmxg-73gg-4p98	npm	jquery	<1.12.2	1.12.2
GHSA-rmxg-73gg-4p98	NuGet	jQuery	<1.12.2	1.12.2
GHSA-rmxg-73gg-4p98	NuGet	jQuery	>=1.12.3 <3.0.0	3.0.0
GHSA-rmxg-73gg-4p98	npm	jquery	>=1.12.3 <3.0.0	3.0.0
GHSA-rmxg-73gg-4p98	RubyGems	jquery-rails	<4.2.0	4.2.0
GHSA-rmxg-73gg-4p98	Maven	org.webjars.npm:jquery	<1.12.2	1.12.2
GHSA-rmxg-73gg-4p98	Maven	org.webjars.npm:jquery	>=1.12.3 <3.0.0	3.0.0

References

Check your stack JSON