WS-2016-0048 | Mend Vulnerability Database

Vulnerability DatabaseWS-2016-0048

WS-2016-0048

Published:May 19, 2026

Updated:May 19, 2026

"C3 is a D3-based reusable chart library that enables deeper integration of charts into web applications.Versions 0.4.10 and lower of c3 contain a cross site scripting (XSS) vulnerability through improper html sanitization on rendered tooltips."

Affected Packages

c3 (CDN_JS):

Affected version(s) >=0.1.1 <0.4.11

Fix Suggestion:

Update to version 0.4.11

c3 (NPM):

Affected version(s) >=0.0.1 <0.4.11

Fix Suggestion:

Update to version 0.4.11

cloudsu.ui.theme.uplon (NUGET):

Affected version(s) >=0.0.1 <=0.0.2

Fix Suggestion:

Update to version no_fix

basemodule (NUGET):

Affected version(s) =0.0.31-alpha

Fix Suggestion:

Update to version no_fix

c3 (NUGET):

Affected version(s) >=0.2.5 <=0.4.8.1

Fix Suggestion:

Update to version no_fix

nisimpo/auth (PHP):

Affected version(s) >=dev-dev <=v1.0.1

Fix Suggestion:

Update to version no_fix

mohammadsaleh/spider-app (PHP):

Affected version(s) >=dev-master <2.1

Fix Suggestion:

Update to version 2.1

ibexa/experience-skeleton (PHP):

Affected version(s) >=v3.3.0 <v3.3.3

Fix Suggestion:

Update to version v3.3.3

mauricioschmitz/homer-assets (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

fedorov-aleksey/yii2-package-theme-absolute-admin (PHP):

Affected version(s) >=dev-master <v1.0.2

Fix Suggestion:

Update to version v1.0.2

awsmug/torro-forms (PHP):

Affected version(s) >=dev-master <1.0.0-beta.10

Fix Suggestion:

Update to version 1.0.0-beta.10

hakoncms/hakoncms (PHP):

Affected version(s) =dev-dev

Fix Suggestion:

Update to version no_fix

awsmug/torro-forms (PHP):

Affected version(s) >=1.0.6 <1.0.8

Fix Suggestion:

Update to version 1.0.8

msbios/cpanel (PHP):

Affected version(s) >=dev-master <v1.0.44

Fix Suggestion:

Update to version v1.0.44

osidea/eosadm (PHP):

Affected version(s) >=0.0.2-beta.2 <=0.0.3-beta.3

Fix Suggestion:

Update to version no_fix

topazcms/core (PHP):

Affected version(s) >=dev-develop <=dev-master

Fix Suggestion:

Update to version no_fix

lanos/yetiweb (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

hotspotbilling/phpnuxbill (PHP):

Affected version(s) >=dev-Development <dev-NewSystem

Fix Suggestion:

Update to version dev-NewSystem

brt/blog-bundle (PHP):

Affected version(s) =v0.8.0 <0.8.1

Fix Suggestion:

Update to version 0.8.1

ibexa/content-skeleton (PHP):

Affected version(s) >=v3.3.0 <v3.3.3

Fix Suggestion:

Update to version v3.3.3

yii2mod/yii2-c3-chart (PHP):

Affected version(s) >=0.1 <1.0

Fix Suggestion:

Update to version 1.0

torralbodavid/duck-funk-core (PHP):

Affected version(s) =v0.3.0 <v0.4.0

Fix Suggestion:

Update to version v0.4.0

brt/blog-bundle (PHP):

Affected version(s) >=0.8.3.0 <0.8.3.2

Fix Suggestion:

Update to version 0.8.3.2

acosf/archersys (PHP):

Affected version(s) >=dev-hdddwinstudent <1.0

Fix Suggestion:

Update to version 1.0

centreon/centreon (PHP):

Affected version(s) >=2.99.1 <dev-DEVOPS-automate-dependabot3

Fix Suggestion:

Update to version dev-DEVOPS-automate-dependabot3

zantolov/appbundle (PHP):

Affected version(s) =dev-master <v0.1

Fix Suggestion:

Update to version v0.1

centreon/centreon (PHP):

Affected version(s) =2.7.x-dev <2.7.1

Fix Suggestion:

Update to version 2.7.1

centurion/app (PHP):

Affected version(s) >=dev-master <=0.0.5

Fix Suggestion:

Update to version no_fix

demyanenkomaks/yii2-base (PHP):

Affected version(s) >=dev-master <2.0.0

Fix Suggestion:

Update to version 2.0.0

benmacha/templatebundle (PHP):

Affected version(s) >=1.0.2 <1.0.3.5

Fix Suggestion:

Update to version 1.0.3.5

bizytech/auth (PHP):

Affected version(s) >=dev-main <=v1.0.12

Fix Suggestion:

Update to version no_fix

fastd/asset-bundle (PHP):

Affected version(s) >=dev-dev <=v1.0.1

Fix Suggestion:

Update to version no_fix

torralbodavid/duck-funk-core (PHP):

Affected version(s) >=v0.0.3 <dev-dependabot/npm_and_yarn/decode-uri-component-0.2.2

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/decode-uri-component-0.2.2

handledeck/est-tools (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

youshido/admin (PHP):

Affected version(s) >=dev-develop <0.0.1

Fix Suggestion:

Update to version 0.0.1

rutatiina/ui (PHP):

Affected version(s) =v1.0.0

Fix Suggestion:

Update to version no_fix

ibexa/commerce-skeleton (PHP):

Affected version(s) >=v3.3.0 <v3.3.3

Fix Suggestion:

Update to version v3.3.3

fedorov-aleksey/yii2-package-theme-absolute-admin (PHP):

Affected version(s) >=v1.0.3 <=v1.1.2

Fix Suggestion:

Update to version no_fix

o2relax/laravel-shop (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

brt/blog-bundle (PHP):

Affected version(s) >=dev-feature/Public_part_of_bundle <0.8.0

Fix Suggestion:

Update to version 0.8.0

intelogie/c3 (PHP):

Affected version(s) =dev-master <0.1.1

Fix Suggestion:

Update to version 0.1.1

msbios/cpanel (PHP):

Affected version(s) =v1.0.67

Fix Suggestion:

Update to version no_fix

auth0/wordpress (PHP):

Affected version(s) >=2.0.0 <4.0.0

Fix Suggestion:

Update to version 4.0.0

benmacha/templatebundle (PHP):

Affected version(s) =dev-master <1.0.0

Fix Suggestion:

Update to version 1.0.0

osidea/eosadm (PHP):

Affected version(s) >=dev-master <0.0.2-beta.1

Fix Suggestion:

Update to version 0.0.2-beta.1

icekristal/yii2-adminpanel-and-start-project (PHP):

Affected version(s) =dev-master <dev-new_desing

Fix Suggestion:

Update to version dev-new_desing

centreon/centreon (PHP):

Affected version(s) =2.7.3 <2.7.4

Fix Suggestion:

Update to version 2.7.4

sonlabs/php-paypal (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

brt/blog-bundle (PHP):

Affected version(s) >=0.8.3.3 <=1.0.7

Fix Suggestion:

Update to version no_fix

symfomany/laravelcinema (PHP):

Affected version(s) >=dev-analysis-qolAKz <=dev-analysis-z9mbVa

Fix Suggestion:

Update to version no_fix

hotspotbilling/phpnuxbill (PHP):

Affected version(s) >=dev-codecanyon <dev-newRadius

Fix Suggestion:

Update to version dev-newRadius

awsmug/torro-forms (PHP):

Affected version(s) >=1.0.0-beta.4 <1.0.0-beta.6

Fix Suggestion:

Update to version 1.0.0-beta.6

awsmug/torro-forms (PHP):

Affected version(s) =1.0.0-beta.7 <1.0.0-beta.8

Fix Suggestion:

Update to version 1.0.0-beta.8

msbios/cpanel (PHP):

Affected version(s) >=v1.0.45 <v1.0.48

Fix Suggestion:

Update to version v1.0.48

centreon/centreon (PHP):

Affected version(s) =dev-centreond <dev-challengeWebService

Fix Suggestion:

Update to version dev-challengeWebService

zantolov/appbundle (PHP):

Affected version(s) =dev-develop-symfony3

Fix Suggestion:

Update to version no_fix

centreon/centreon (PHP):

Affected version(s) =dev-experimental <dev-extensions-UI

Fix Suggestion:

Update to version dev-extensions-UI

hotspotbilling/phpnuxbill (PHP):

Affected version(s) >=2023.3.6 <2024.2.26

Fix Suggestion:

Update to version 2024.2.26

jspaine/cyii (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

icekristal/yii2-adminpanel-and-start-project (PHP):

Affected version(s) >=v1.0.1 <4.0

Fix Suggestion:

Update to version 4.0

m-comscience/yii2-homer-asset (PHP):

Affected version(s) >=dev-master <=v1.0.0

Fix Suggestion:

Update to version no_fix

youshido/admin (PHP):

Affected version(s) =dev-sf2-version

Fix Suggestion:

Update to version no_fix

Related Resources (2)

https://github.com/c3js/c3/issues/1536

https://github.com/c3js/c3/commit/de3864650300488a63d0541620e9828b00e94b42

Do you need more information?

CVSS v4

Base Score:

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

PASSIVE

Vulnerable System Confidentiality

LOW

Vulnerable System Integrity

LOW

Vulnerable System Availability

NONE

Subsequent System Confidentiality

LOW

Subsequent System Integrity

LOW

Subsequent System Availability

NONE

CVSS v3

Base Score:

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE