WS-2016-0048 | Mend Vulnerability Database

Vulnerability DatabaseWS-2016-0048

WS-2016-0048

Published:May 19, 2026

Updated:May 19, 2026

"C3 is a D3-based reusable chart library that enables deeper integration of charts into web applications.Versions 0.4.10 and lower of c3 contain a cross site scripting (XSS) vulnerability through improper html sanitization on rendered tooltips."

Affected Packages

c3 (CDN_JS):

Affected version(s) >=0.1.1 <0.4.11

Fix Suggestion:

Update to version 0.4.11

c3 (NPM):

Affected version(s) >=0.0.1 <0.4.11

Fix Suggestion:

Update to version 0.4.11

basemodule (NUGET):

Affected version(s) =0.0.31-alpha

Fix Suggestion:

Update to version no_fix

cloudsu.ui.theme.uplon (NUGET):

Affected version(s) >=0.0.1 <=0.0.2

Fix Suggestion:

Update to version no_fix

c3 (NUGET):

Affected version(s) >=0.2.5 <=0.4.8.1

Fix Suggestion:

Update to version no_fix

awsmug/torro-forms (PHP):

Affected version(s) >=1.0.6 <1.0.8

Fix Suggestion:

Update to version 1.0.8

ibexa/commerce-skeleton (PHP):

Affected version(s) >=v3.3.0 <v3.3.3

Fix Suggestion:

Update to version v3.3.3

mohammadsaleh/spider-app (PHP):

Affected version(s) >=dev-master <2.1

Fix Suggestion:

Update to version 2.1

intelogie/c3 (PHP):

Affected version(s) =dev-master <0.1.1

Fix Suggestion:

Update to version 0.1.1

rutatiina/ui (PHP):

Affected version(s) =v1.0.0

Fix Suggestion:

Update to version no_fix

centreon/centreon (PHP):

Affected version(s) >=2.99.1 <dev-DEVOPS-automate-dependabot3

Fix Suggestion:

Update to version dev-DEVOPS-automate-dependabot3

lanos/yetiweb (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

fastd/asset-bundle (PHP):

Affected version(s) >=dev-dev <=v1.0.1

Fix Suggestion:

Update to version no_fix

youshido/admin (PHP):

Affected version(s) =dev-sf2-version

Fix Suggestion:

Update to version no_fix

msbios/cpanel (PHP):

Affected version(s) =v1.0.67

Fix Suggestion:

Update to version no_fix

ibexa/experience-skeleton (PHP):

Affected version(s) >=v3.3.0 <v3.3.3

Fix Suggestion:

Update to version v3.3.3

hotspotbilling/phpnuxbill (PHP):

Affected version(s) >=2023.3.6 <2024.2.26

Fix Suggestion:

Update to version 2024.2.26

mauricioschmitz/homer-assets (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

bizytech/auth (PHP):

Affected version(s) >=dev-main <=v1.0.12

Fix Suggestion:

Update to version no_fix

icekristal/yii2-adminpanel-and-start-project (PHP):

Affected version(s) >=v1.0.1 <4.0

Fix Suggestion:

Update to version 4.0

awsmug/torro-forms (PHP):

Affected version(s) >=dev-master <1.0.0-beta.10

Fix Suggestion:

Update to version 1.0.0-beta.10

handledeck/est-tools (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

auth0/wordpress (PHP):

Affected version(s) >=2.0.0 <4.0.0

Fix Suggestion:

Update to version 4.0.0

fedorov-aleksey/yii2-package-theme-absolute-admin (PHP):

Affected version(s) >=dev-master <v1.0.2

Fix Suggestion:

Update to version v1.0.2

hotspotbilling/phpnuxbill (PHP):

Affected version(s) >=dev-Development <dev-NewSystem

Fix Suggestion:

Update to version dev-NewSystem

o2relax/laravel-shop (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

centreon/centreon (PHP):

Affected version(s) =dev-centreond <dev-challengeWebService

Fix Suggestion:

Update to version dev-challengeWebService

nisimpo/auth (PHP):

Affected version(s) >=dev-dev <=v1.0.1

Fix Suggestion:

Update to version no_fix

brt/blog-bundle (PHP):

Affected version(s) =v0.8.0 <0.8.1

Fix Suggestion:

Update to version 0.8.1

symfomany/laravelcinema (PHP):

Affected version(s) >=dev-analysis-qolAKz <=dev-analysis-z9mbVa

Fix Suggestion:

Update to version no_fix

sonlabs/php-paypal (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

awsmug/torro-forms (PHP):

Affected version(s) =1.0.0-beta.7 <1.0.0-beta.8

Fix Suggestion:

Update to version 1.0.0-beta.8

brt/blog-bundle (PHP):

Affected version(s) >=dev-feature/Public_part_of_bundle <0.8.0

Fix Suggestion:

Update to version 0.8.0

benmacha/templatebundle (PHP):

Affected version(s) =dev-master <1.0.0

Fix Suggestion:

Update to version 1.0.0

osidea/eosadm (PHP):

Affected version(s) >=dev-master <0.0.2-beta.1

Fix Suggestion:

Update to version 0.0.2-beta.1

torralbodavid/duck-funk-core (PHP):

Affected version(s) >=v0.0.3 <dev-dependabot/npm_and_yarn/decode-uri-component-0.2.2

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/decode-uri-component-0.2.2

demyanenkomaks/yii2-base (PHP):

Affected version(s) >=dev-master <2.0.0

Fix Suggestion:

Update to version 2.0.0

msbios/cpanel (PHP):

Affected version(s) >=v1.0.45 <v1.0.48

Fix Suggestion:

Update to version v1.0.48

centreon/centreon (PHP):

Affected version(s) =dev-experimental <dev-extensions-UI

Fix Suggestion:

Update to version dev-extensions-UI

yii2mod/yii2-c3-chart (PHP):

Affected version(s) >=0.1 <1.0

Fix Suggestion:

Update to version 1.0

msbios/cpanel (PHP):

Affected version(s) >=dev-master <v1.0.44

Fix Suggestion:

Update to version v1.0.44

icekristal/yii2-adminpanel-and-start-project (PHP):

Affected version(s) =dev-master <dev-new_desing

Fix Suggestion:

Update to version dev-new_desing

osidea/eosadm (PHP):

Affected version(s) >=0.0.2-beta.2 <=0.0.3-beta.3

Fix Suggestion:

Update to version no_fix

centreon/centreon (PHP):

Affected version(s) =2.7.3 <2.7.4

Fix Suggestion:

Update to version 2.7.4

acosf/archersys (PHP):

Affected version(s) >=dev-hdddwinstudent <1.0

Fix Suggestion:

Update to version 1.0

centurion/app (PHP):

Affected version(s) >=dev-master <=0.0.5

Fix Suggestion:

Update to version no_fix

topazcms/core (PHP):

Affected version(s) >=dev-develop <=dev-master

Fix Suggestion:

Update to version no_fix

ibexa/content-skeleton (PHP):

Affected version(s) >=v3.3.0 <v3.3.3

Fix Suggestion:

Update to version v3.3.3

centreon/centreon (PHP):

Affected version(s) =2.7.x-dev <2.7.1

Fix Suggestion:

Update to version 2.7.1

hotspotbilling/phpnuxbill (PHP):

Affected version(s) >=dev-codecanyon <dev-newRadius

Fix Suggestion:

Update to version dev-newRadius

brt/blog-bundle (PHP):

Affected version(s) >=0.8.3.0 <0.8.3.2

Fix Suggestion:

Update to version 0.8.3.2

torralbodavid/duck-funk-core (PHP):

Affected version(s) =v0.3.0 <v0.4.0

Fix Suggestion:

Update to version v0.4.0

zantolov/appbundle (PHP):

Affected version(s) =dev-master <v0.1

Fix Suggestion:

Update to version v0.1

brt/blog-bundle (PHP):

Affected version(s) >=0.8.3.3 <=1.0.7

Fix Suggestion:

Update to version no_fix

m-comscience/yii2-homer-asset (PHP):

Affected version(s) >=dev-master <=v1.0.0

Fix Suggestion:

Update to version no_fix

benmacha/templatebundle (PHP):

Affected version(s) >=1.0.2 <1.0.3.5

Fix Suggestion:

Update to version 1.0.3.5

jspaine/cyii (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

hakoncms/hakoncms (PHP):

Affected version(s) =dev-dev

Fix Suggestion:

Update to version no_fix

youshido/admin (PHP):

Affected version(s) >=dev-develop <0.0.1

Fix Suggestion:

Update to version 0.0.1

awsmug/torro-forms (PHP):

Affected version(s) >=1.0.0-beta.4 <1.0.0-beta.6

Fix Suggestion:

Update to version 1.0.0-beta.6

fedorov-aleksey/yii2-package-theme-absolute-admin (PHP):

Affected version(s) >=v1.0.3 <=v1.1.2

Fix Suggestion:

Update to version no_fix

zantolov/appbundle (PHP):

Affected version(s) =dev-develop-symfony3

Fix Suggestion:

Update to version no_fix

Related Resources (2)

https://github.com/c3js/c3/commit/de3864650300488a63d0541620e9828b00e94b42

https://github.com/c3js/c3/issues/1536

Do you need more information?

CVSS v4

Base Score:

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

PASSIVE

Vulnerable System Confidentiality

LOW

Vulnerable System Integrity

LOW

Vulnerable System Availability

NONE

Subsequent System Confidentiality

LOW

Subsequent System Integrity

LOW

Subsequent System Availability

NONE

CVSS v3

Base Score:

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE