Vulnerability DatabaseWS-2016-0045
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
WS-2016-0045
Published:May 14, 2026
Updated:May 14, 2026
Versions 1.3.3 and below contain a cross site scripting vulnerability in the drag and drop functionality for modifying tree data. A node that contains a standard XSS vector will have its payload execute when a user attempts to drag a node to a different position in the hierarchy.
Affected Packages
jqtree (CDN_JS):
Affected version(s) >=0.22.0 <1.3.4
Fix Suggestion:
Update to version 1.3.4
jqtree (NPM):
Affected version(s) >=0.22.0 <1.3.4
Fix Suggestion:
Update to version 1.3.4
lionbridge.flexframe.webui (NUGET):
Affected version(s) =1.0.0
Fix Suggestion:
Update to version no_fix
ognestraz/lumen-admin (PHP):
Affected version(s) =dev-master
Fix Suggestion:
Update to version no_fix
ognestraz/admin (PHP):
Affected version(s) =dev-master
Fix Suggestion:
Update to version no_fix
nabble/ajde (PHP):
Affected version(s) >=dev-develop <v0.1
Fix Suggestion:
Update to version v0.1
wislem/berrier (PHP):
Affected version(s) >=dev-master <=v1.0.8.8
Fix Suggestion:
Update to version no_fix
bigfoot/core-bundle (PHP):
Affected version(s) =3.0.x-dev
Fix Suggestion:
Update to version no_fix
su-sws/stanford_capx (PHP):
Affected version(s) >=dev-7.x-2.x <7.3.0-beta.15
Fix Suggestion:
Update to version 7.3.0-beta.15
su-sws/stanford_capx (PHP):
Affected version(s) >=7.3.0-beta.16 <7.3.0-beta10
Fix Suggestion:
Update to version 7.3.0-beta10
forecho/yii2-jqtree (PHP):
Affected version(s) >=dev-master <=0.1.0
Fix Suggestion:
Update to version no_fix
majes/cms-bundle (PHP):
Affected version(s) >=dev-master <=v2.0.7
Fix Suggestion:
Update to version no_fix
bigfoot/core-bundle (PHP):
Affected version(s) =2.2.x-dev <v2.2.0
Fix Suggestion:
Update to version v2.2.0
nabble/ajde (PHP):
Affected version(s) >=v0.3.1 <=v1.0.0-alpha1
Fix Suggestion:
Update to version no_fix
bigfoot/core-bundle (PHP):
Affected version(s) >=dev-add-date-filter <1.0.0
Fix Suggestion:
Update to version 1.0.0
su-sws/stanford_capx (PHP):
Affected version(s) =7.x-3.0-beta14 <7.x-3.0-beta15
Fix Suggestion:
Update to version 7.x-3.0-beta15
webvimark/jqtreewidget (PHP):
Affected version(s) >=dev-master <=1.0.0
Fix Suggestion:
Update to version no_fix
Related Resources (2)
https://github.com/mbraak/jqTree/commit/3a19f0c177c7ab9d25fff62d1b28c94f1574c3d0
https://github.com/mbraak/jqTree/issues/437
Do you need more information?
Contact Us
CVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE