{"id":"CVE-2015-6584","aliases":["DEBIAN-CVE-2015-6584","EUVD-2020-0590","GHSA-4mv4-gmmf-q382","UBUNTU-CVE-2015-6584"],"status":"published","title":"DataTable Vulnerable to Cross-Site Scripting","description":"Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02679,"percentile":0.85897,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2015-09-11T15:00:00Z","modified":"2026-09-09T06:47:27Z","fixes":[{"ecosystem":"npm","package":"datatables","fixed_in":["1.10.10"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"datatables/datatables","fixed_in":["1.10.10"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"datatables.js","fixed_in":["1.10.9+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"datatables.js","fixed_in":["1.10.9+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"datatables.js","fixed_in":["1.10.9+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"datatables","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.10"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"datatables/datatables","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"datatables.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.9+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"datatables.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.9+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"datatables.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.9+dfsg-1"}]}]},{"source":"osv","ecosystem":"npm","package":"datatables","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.10.10"}]}]},{"source":"osv","ecosystem":"Packagist","package":"datatables/datatables","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.10"}]}],"versions":["1.10.0","1.10.0-beta.1","1.10.0-beta.2","1.10.0-rc.1","1.10.1","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10.9"]}],"products":[{"vendor":"sprymedia","product":"datatables"}],"references":[{"url":"http://packetstormsecurity.com/files/133555/DataTables-1.10.8-Cross-Site-Scripting.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.securityfocus.com/archive/1/536437/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"https://www.netsparker.com/cve-2015-6384-xss-vulnerability-identified-in-datatables/","tags":["x_refsource_MISC","x_transferred","Exploit","evidence","report"]},{"url":"http://seclists.org/fulldisclosure/2015/Sep/37","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"https://github.com/DataTables/DataTables/issues/602","tags":["web","report"]},{"url":"https://github.com/DataTables/DataTablesSrc/commit/ccf86dc5982bd8e16d","tags":["web","report"]},{"url":"https://www.npmjs.com/advisories/5","tags":["web"]},{"url":"http://www.securityfocus.com/archive/1/archive/1/536437/100/0/threaded","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6584","tags":["advisory"]},{"url":"https://github.com/DataTables/DataTablesSrc/commits/1.10.10?after=9780a3693572757d87bf70e48bd7555faf974f28+34\u0026branch=1.10.10\u0026qualified_name=refs%2Ftags%2F1.10.10","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4mv4-gmmf-q382"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-6584","tags":["advisory"]},{"url":"https://github.com/DataTables/DataTables","tags":["package"]},{"url":"https://www.netsparker.com/cve-2015-6384-xss-vulnerability-identified-in-datatables","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-6584","tags":["report"]},{"url":"https://nodesecurity.io/advisories/5","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-6584","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-6584","description":"Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.","status":"published","published":"2015-09-11T15:00:00Z","modified":"2024-08-06T07:22:22.25Z","updated_at":"2026-11-02T14:35:42.680858Z"}],"euvd":[{"id":"EUVD-2020-0590","description":"Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.","status":"published","published":"2015-09-11T15:00:00Z","modified":"2024-08-06T07:22:22Z","updated_at":"2026-11-03T02:21:55.290228Z"}],"ghsa":[{"id":"GHSA-4mv4-gmmf-q382","title":"DataTable Vulnerable to Cross-Site Scripting","description":"Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.\n\n\n## Recommendation\n\nUpdate to a version greater than 1.10.8. A [fix](https://github.com/DataTables/DataTablesSrc/commit/ccf86dc5982bd8e16d) appears in [version 1.10.10](https://github.com/DataTables/DataTablesSrc/commits/1.10.10?after=9780a3693572757d87bf70e48bd7555faf974f28+34\u0026branch=1.10.10\u0026qualified_name=refs%2Ftags%2F1.10.10).","status":"published","published":"2020-08-31T22:42:29Z","modified":"2023-09-14T12:04:08Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:05.004935Z"}],"nvd":[{"id":"CVE-2015-6584","description":"Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.","status":"published","published":"2015-09-11T15:59:00.097Z","modified":"2026-06-17T00:31:05.59Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:09.92183Z"}],"osv":[{"id":"CVE-2015-6584","description":"Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.","status":"published","published":"2015-09-11T15:59:00Z","modified":"2026-04-10T03:46:25.725144Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-6584","description":"Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.","status":"published","published":"2015-09-11T15:59:00.097Z","modified":"2026-09-09T06:47:27.24007559Z","updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"GHSA-4mv4-gmmf-q382","title":"DataTable Vulnerable to Cross-Site Scripting","description":"Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.\n\n\n## Recommendation\n\nUpdate to a version greater than 1.10.8. A [fix](https://github.com/DataTables/DataTablesSrc/commit/ccf86dc5982bd8e16d) appears in [version 1.10.10](https://github.com/DataTables/DataTablesSrc/commits/1.10.10?after=9780a3693572757d87bf70e48bd7555faf974f28+34\u0026branch=1.10.10\u0026qualified_name=refs%2Ftags%2F1.10.10).","status":"published","published":"2020-08-31T22:42:29Z","modified":"2024-12-03T06:08:04.425385Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"UBUNTU-CVE-2015-6584","description":"Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.","status":"withdrawn","published":"2015-09-11T15:59:00Z","modified":"2025-07-16T08:11:40.256296Z","updated_at":"2026-11-02T15:54:10.385269Z"}]}}