VYPR
Get started
← All advisories
High severityNVD Advisory· Published Sep 11, 2015· Updated May 6, 2026

CVE-2015-6584

CVE-2015-6584

Description

Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
datatablesnpm
< 1.10.101.10.10
datatables/datatablesPackagist
< 1.10.101.10.10

Affected products

1

Patches

1
ccf86dc5982b

Dev: Fix potential XSS in the unit test scripts

https://github.com/DataTables/DataTablesSrcAllan JardineSep 8, 2015via ghsa
commit
14 files changed · +14 −14
  • tests/templates/2512.php+1 −1 modified
    @@ -22,7 +22,7 @@
 			$aScripts = explode( ":", $_GET['scripts'] );
 			for ( $i=0 ; $i<count($aScripts) ; $i++ )
 			{
-				echo '<script type="text/javascript" language="javascript" src="../'.$aScripts[$i].'?rand='.rand().'"></script>'."\n";
+				echo '<script type="text/javascript" language="javascript" src="../'.htmlentities($aScripts[$i]).'?rand='.rand().'"></script>'."\n";
 			}
 		?>
 	</head>
  • tests/templates/6776.php+1 −1 modified
    @@ -22,7 +22,7 @@
 			$aScripts = explode( ":", $_GET['scripts'] );
 			for ( $i=0 ; $i<count($aScripts) ; $i++ )
 			{
-				echo '<script type="text/javascript" language="javascript" src="../'.$aScripts[$i].'?rand='.rand().'"></script>'."\n";
+				echo '<script type="text/javascript" language="javascript" src="../'.htmlentities($aScripts[$i]).'?rand='.rand().'"></script>'."\n";
 			}
 		?>
 	</head>
  • tests/templates/complex_header_2.php+1 −1 modified
    @@ -22,7 +22,7 @@
 			$aScripts = explode( ":", $_GET['scripts'] );
 			for ( $i=0 ; $i<count($aScripts) ; $i++ )
 			{
-				echo '<script type="text/javascript" language="javascript" src="../'.$aScripts[$i].'?rand='.rand().'"></script>'."\n";
+				echo '<script type="text/javascript" language="javascript" src="../'.htmlentities($aScripts[$i]).'?rand='.rand().'"></script>'."\n";
 			}
 		?>
 	</head>
  • tests/templates/-complex_header.php+1 −1 modified
    @@ -22,7 +22,7 @@
 			$aScripts = explode( ":", $_GET['scripts'] );
 			for ( $i=0 ; $i<count($aScripts) ; $i++ )
 			{
-				echo '<script type="text/javascript" language="javascript" src="../'.$aScripts[$i].'?rand='.rand().'"></script>'."\n";
+				echo '<script type="text/javascript" language="javascript" src="../'.htmlentities($aScripts[$i]).'?rand='.rand().'"></script>'."\n";
 			}
 		?>
 	</head>
  • tests/templates/deferred_table.php+1 −1 modified
    @@ -22,7 +22,7 @@
 			$aScripts = explode( ":", $_GET['scripts'] );
 			for ( $i=0 ; $i<count($aScripts) ; $i++ )
 			{
-				echo '<script type="text/javascript" language="javascript" src="../'.$aScripts[$i].'?rand='.rand().'"></script>'."\n";
+				echo '<script type="text/javascript" language="javascript" src="../'.htmlentities($aScripts[$i]).'?rand='.rand().'"></script>'."\n";
 			}
 		?>
 	</head>
  • tests/templates/dom_data.php+1 −1 modified
    @@ -22,7 +22,7 @@
 			$aScripts = explode( ":", $_GET['scripts'] );
 			for ( $i=0 ; $i<count($aScripts) ; $i++ )
 			{
-				echo '<script type="text/javascript" language="javascript" src="../'.$aScripts[$i].'?rand='.rand().'"></script>'."\n";
+				echo '<script type="text/javascript" language="javascript" src="../'.htmlentities($aScripts[$i]).'?rand='.rand().'"></script>'."\n";
 			}
 		?>
 	</head>
  • tests/templates/dom_data_th.php+1 −1 modified
    @@ -22,7 +22,7 @@
 			$aScripts = explode( ":", $_GET['scripts'] );
 			for ( $i=0 ; $i<count($aScripts) ; $i++ )
 			{
-				echo '<script type="text/javascript" language="javascript" src="../'.$aScripts[$i].'?rand='.rand().'"></script>'."\n";
+				echo '<script type="text/javascript" language="javascript" src="../'.htmlentities($aScripts[$i]).'?rand='.rand().'"></script>'."\n";
 			}
 		?>
 	</head>
  • tests/templates/dom_data_two_headers.php+1 −1 modified
    @@ -22,7 +22,7 @@
 			$aScripts = explode( ":", $_GET['scripts'] );
 			for ( $i=0 ; $i<count($aScripts) ; $i++ )
 			{
-				echo '<script type="text/javascript" language="javascript" src="../'.$aScripts[$i].'?rand='.rand().'"></script>'."\n";
+				echo '<script type="text/javascript" language="javascript" src="../'.htmlentities($aScripts[$i]).'?rand='.rand().'"></script>'."\n";
 			}
 		?>
 	</head>
  • tests/templates/dymanic_table.php+1 −1 modified
    @@ -27,7 +27,7 @@
 			$aScripts = explode( ":", $_GET['scripts'] );
 			for ( $i=0 ; $i<count($aScripts) ; $i++ )
 			{
-				echo '<script type="text/javascript" language="javascript" src="../'.$aScripts[$i].'?rand='.rand().'"></script>'."\n";
+				echo '<script type="text/javascript" language="javascript" src="../'.htmlentities($aScripts[$i]).'?rand='.rand().'"></script>'."\n";
 			}
 		?>
 	</head>
  • tests/templates/empty_table.php+1 −1 modified
    @@ -22,7 +22,7 @@
 			$aScripts = explode( ":", $_GET['scripts'] );
 			for ( $i=0 ; $i<count($aScripts) ; $i++ )
 			{
-				echo '<script type="text/javascript" language="javascript" src="../'.$aScripts[$i].'?rand='.rand().'"></script>'."\n";
+				echo '<script type="text/javascript" language="javascript" src="../'.htmlentities($aScripts[$i]).'?rand='.rand().'"></script>'."\n";
 			}
 		?>
 	</head>
  • tests/templates/html_table.php+1 −1 modified
    @@ -22,7 +22,7 @@
 			$aScripts = explode( ":", $_GET['scripts'] );
 			for ( $i=0 ; $i<count($aScripts) ; $i++ )
 			{
-				echo '<script type="text/javascript" language="javascript" src="../'.$aScripts[$i].'?rand='.rand().'"></script>'."\n";
+				echo '<script type="text/javascript" language="javascript" src="../'.htmlentities($aScripts[$i]).'?rand='.rand().'"></script>'."\n";
 			}
 		?>
 	</head>
  • tests/templates/js_data_mixed_types.php+1 −1 modified
    @@ -84,7 +84,7 @@
 			$aScripts = explode( ":", $_GET['scripts'] );
 			for ( $i=0 ; $i<count($aScripts) ; $i++ )
 			{
-				echo '<script type="text/javascript" language="javascript" src="../'.$aScripts[$i].'?rand='.rand().'"></script>'."\n";
+				echo '<script type="text/javascript" language="javascript" src="../'.htmlentities($aScripts[$i]).'?rand='.rand().'"></script>'."\n";
 			}
 		?>
 	</head>
  • tests/templates/js_data.php+1 −1 modified
    @@ -84,7 +84,7 @@
 			$aScripts = explode( ":", $_GET['scripts'] );
 			for ( $i=0 ; $i<count($aScripts) ; $i++ )
 			{
-				echo '<script type="text/javascript" language="javascript" src="../'.$aScripts[$i].'?rand='.rand().'"></script>'."\n";
+				echo '<script type="text/javascript" language="javascript" src="../'.htmlentities($aScripts[$i]).'?rand='.rand().'"></script>'."\n";
 			}
 		?>
 	</head>
  • tests/templates/two_tables.php+1 −1 modified
    @@ -22,7 +22,7 @@
 			$aScripts = explode( ":", $_GET['scripts'] );
 			for ( $i=0 ; $i<count($aScripts) ; $i++ )
 			{
-				echo '<script type="text/javascript" language="javascript" src="../'.$aScripts[$i].'?rand='.rand().'"></script>'."\n";
+				echo '<script type="text/javascript" language="javascript" src="../'.htmlentities($aScripts[$i]).'?rand='.rand().'"></script>'."\n";
 			}
 		?>
 	</head>

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

12

News mentions

0

No linked articles in our index yet.