WS-2016-0048 | Mend Vulnerability Database

Vulnerability DatabaseWS-2016-0048

WS-2016-0048

Published:May 13, 2026

Updated:May 13, 2026

"C3 is a D3-based reusable chart library that enables deeper integration of charts into web applications.Versions 0.4.10 and lower of c3 contain a cross site scripting (XSS) vulnerability through improper html sanitization on rendered tooltips."

Affected Packages

c3 (CDN_JS):

Affected version(s) >=0.1.1 <0.4.11

Fix Suggestion:

Update to version 0.4.11

c3 (NPM):

Affected version(s) >=0.0.1 <0.4.11

Fix Suggestion:

Update to version 0.4.11

c3 (NUGET):

Affected version(s) >=0.2.5 <=0.4.8.1

Fix Suggestion:

Update to version no_fix

cloudsu.ui.theme.uplon (NUGET):

Affected version(s) >=0.0.1 <=0.0.2

Fix Suggestion:

Update to version no_fix

basemodule (NUGET):

Affected version(s) =0.0.31-alpha

Fix Suggestion:

Update to version no_fix

mohammadsaleh/spider-app (PHP):

Affected version(s) >=dev-master <2.1

Fix Suggestion:

Update to version 2.1

jspaine/cyii (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

awsmug/torro-forms (PHP):

Affected version(s) >=1.0.0-beta.4 <1.0.0-beta.6

Fix Suggestion:

Update to version 1.0.0-beta.6

fedorov-aleksey/yii2-package-theme-absolute-admin (PHP):

Affected version(s) >=v1.0.3 <=v1.1.2

Fix Suggestion:

Update to version no_fix

fedorov-aleksey/yii2-package-theme-absolute-admin (PHP):

Affected version(s) >=dev-master <v1.0.2

Fix Suggestion:

Update to version v1.0.2

zantolov/appbundle (PHP):

Affected version(s) =dev-master <v0.1

Fix Suggestion:

Update to version v0.1

youshido/admin (PHP):

Affected version(s) =dev-sf2-version

Fix Suggestion:

Update to version no_fix

youshido/admin (PHP):

Affected version(s) >=dev-develop <0.0.1

Fix Suggestion:

Update to version 0.0.1

nisimpo/auth (PHP):

Affected version(s) >=dev-dev <=v1.0.1

Fix Suggestion:

Update to version no_fix

awsmug/torro-forms (PHP):

Affected version(s) =1.0.0-beta.7 <1.0.0-beta.8

Fix Suggestion:

Update to version 1.0.0-beta.8

centreon/centreon (PHP):

Affected version(s) =dev-centreond <dev-challengeWebService

Fix Suggestion:

Update to version dev-challengeWebService

brt/blog-bundle (PHP):

Affected version(s) >=0.8.3.3 <=1.0.7

Fix Suggestion:

Update to version no_fix

benmacha/templatebundle (PHP):

Affected version(s) =dev-master <1.0.0

Fix Suggestion:

Update to version 1.0.0

fastd/asset-bundle (PHP):

Affected version(s) >=dev-dev <=v1.0.1

Fix Suggestion:

Update to version no_fix

m-comscience/yii2-homer-asset (PHP):

Affected version(s) >=dev-master <=v1.0.0

Fix Suggestion:

Update to version no_fix

mauricioschmitz/homer-assets (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

symfomany/laravelcinema (PHP):

Affected version(s) >=dev-analysis-qolAKz <=dev-analysis-z9mbVa

Fix Suggestion:

Update to version no_fix

brt/blog-bundle (PHP):

Affected version(s) >=0.8.3.0 <0.8.3.2

Fix Suggestion:

Update to version 0.8.3.2

lanos/yetiweb (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

sonlabs/php-paypal (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

hotspotbilling/phpnuxbill (PHP):

Affected version(s) >=2023.3.6 <2024.2.26

Fix Suggestion:

Update to version 2024.2.26

centreon/centreon (PHP):

Affected version(s) =dev-experimental <dev-extensions-UI

Fix Suggestion:

Update to version dev-extensions-UI

hotspotbilling/phpnuxbill (PHP):

Affected version(s) >=dev-codecanyon <dev-newRadius

Fix Suggestion:

Update to version dev-newRadius

torralbodavid/duck-funk-core (PHP):

Affected version(s) >=v0.0.3 <dev-dependabot/npm_and_yarn/decode-uri-component-0.2.2

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/decode-uri-component-0.2.2

centurion/app (PHP):

Affected version(s) >=dev-master <=0.0.5

Fix Suggestion:

Update to version no_fix

centreon/centreon (PHP):

Affected version(s) =2.7.x-dev <2.7.1

Fix Suggestion:

Update to version 2.7.1

awsmug/torro-forms (PHP):

Affected version(s) >=dev-master <1.0.0-beta.10

Fix Suggestion:

Update to version 1.0.0-beta.10

osidea/eosadm (PHP):

Affected version(s) >=0.0.2-beta.2 <=0.0.3-beta.3

Fix Suggestion:

Update to version no_fix

o2relax/laravel-shop (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

torralbodavid/duck-funk-core (PHP):

Affected version(s) =v0.3.0 <v0.4.0

Fix Suggestion:

Update to version v0.4.0

bizytech/auth (PHP):

Affected version(s) >=dev-main <=v1.0.12

Fix Suggestion:

Update to version no_fix

ibexa/experience-skeleton (PHP):

Affected version(s) >=v3.3.0 <v3.3.3

Fix Suggestion:

Update to version v3.3.3

auth0/wordpress (PHP):

Affected version(s) >=2.0.0 <4.0.0

Fix Suggestion:

Update to version 4.0.0

hakoncms/hakoncms (PHP):

Affected version(s) =dev-dev

Fix Suggestion:

Update to version no_fix

zantolov/appbundle (PHP):

Affected version(s) =dev-develop-symfony3

Fix Suggestion:

Update to version no_fix

centreon/centreon (PHP):

Affected version(s) =2.7.3 <2.7.4

Fix Suggestion:

Update to version 2.7.4

intelogie/c3 (PHP):

Affected version(s) =dev-master <0.1.1

Fix Suggestion:

Update to version 0.1.1

icekristal/yii2-adminpanel-and-start-project (PHP):

Affected version(s) =dev-master <dev-new_desing

Fix Suggestion:

Update to version dev-new_desing

acosf/archersys (PHP):

Affected version(s) >=dev-hdddwinstudent <1.0

Fix Suggestion:

Update to version 1.0

osidea/eosadm (PHP):

Affected version(s) >=dev-master <0.0.2-beta.1

Fix Suggestion:

Update to version 0.0.2-beta.1

brt/blog-bundle (PHP):

Affected version(s) >=dev-feature/Public_part_of_bundle <0.8.0

Fix Suggestion:

Update to version 0.8.0

msbios/cpanel (PHP):

Affected version(s) =v1.0.67

Fix Suggestion:

Update to version no_fix

yii2mod/yii2-c3-chart (PHP):

Affected version(s) >=0.1 <1.0

Fix Suggestion:

Update to version 1.0

icekristal/yii2-adminpanel-and-start-project (PHP):

Affected version(s) >=v1.0.1 <4.0

Fix Suggestion:

Update to version 4.0

handledeck/est-tools (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

brt/blog-bundle (PHP):

Affected version(s) =v0.8.0 <0.8.1

Fix Suggestion:

Update to version 0.8.1

centreon/centreon (PHP):

Affected version(s) >=2.99.1 <dev-DEVOPS-automate-dependabot3

Fix Suggestion:

Update to version dev-DEVOPS-automate-dependabot3

ibexa/content-skeleton (PHP):

Affected version(s) >=v3.3.0 <v3.3.3

Fix Suggestion:

Update to version v3.3.3

topazcms/core (PHP):

Affected version(s) >=dev-develop <=dev-master

Fix Suggestion:

Update to version no_fix

awsmug/torro-forms (PHP):

Affected version(s) >=1.0.6 <1.0.8

Fix Suggestion:

Update to version 1.0.8

demyanenkomaks/yii2-base (PHP):

Affected version(s) >=dev-master <2.0.0

Fix Suggestion:

Update to version 2.0.0

ibexa/commerce-skeleton (PHP):

Affected version(s) >=v3.3.0 <v3.3.3

Fix Suggestion:

Update to version v3.3.3

hotspotbilling/phpnuxbill (PHP):

Affected version(s) >=dev-Development <dev-NewSystem

Fix Suggestion:

Update to version dev-NewSystem

msbios/cpanel (PHP):

Affected version(s) >=dev-master <v1.0.44

Fix Suggestion:

Update to version v1.0.44

msbios/cpanel (PHP):

Affected version(s) >=v1.0.45 <v1.0.48

Fix Suggestion:

Update to version v1.0.48

rutatiina/ui (PHP):

Affected version(s) =v1.0.0

Fix Suggestion:

Update to version no_fix

benmacha/templatebundle (PHP):

Affected version(s) >=1.0.2 <1.0.3.5

Fix Suggestion:

Update to version 1.0.3.5

Related Resources (2)

https://github.com/c3js/c3/issues/1536

https://github.com/c3js/c3/commit/de3864650300488a63d0541620e9828b00e94b42

Do you need more information?

CVSS v4

Base Score:

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

PASSIVE

Vulnerable System Confidentiality

LOW

Vulnerable System Integrity

LOW

Vulnerable System Availability

NONE

Subsequent System Confidentiality

LOW

Subsequent System Integrity

LOW

Subsequent System Availability

NONE

CVSS v3

Base Score:

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE