CVE-2011-4969
NoneCVSS
—
EPSS
19.2%
Published
Mar 8, 2013
CISA due date
—
The record
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.webjars.npm:jquery | 0 | 1.6.3 |
| NuGet | jQuery | 0 | 1.6.3 |
| RubyGems | jquery-rails | 0 | 1.0.16 |
| npm | jquery | 0 | 1.6.3 |
| Debian:10 | jquery | 0 | 1.6.4-1 |
Related vulnerabilities
- CVE-2020-11022 In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources… Also affects org.webjars.npm:jquery
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96360 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96357 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79