CVE-2020-7656

Published: May 19, 2020Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Affected (9)

Products: Jquery: Jquery · Oracle: Peoplesoft Enterprise Peopletools · Netapp: Active Iq Unified Manager, Cloud Backup, Oncommand System Manager, Snap Creator Framework · +1 more

Show all products

Jquery: Jquery · Oracle: Peoplesoft Enterprise Peopletools · Netapp: Active Iq Unified Manager, Cloud Backup, Oncommand System Manager, Snap Creator Framework · Juniper: Junos

Jquery

1 product

Jquery

Oracle

1 product

Peoplesoft Enterprise Peopletools

Netapp

4 products

Active Iq Unified Manager

Cloud Backup

Oncommand System Manager

Snap Creator Framework

Juniper

1 product

Junos

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jquery Jquery	Before 1.9.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Peoplesoft Enterprise Peopletools	Version 8.58

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Cloud Backup	All versions
Netapp Oncommand System Manager	From 3.0.0 to 3.1.3
Netapp Snap Creator Framework	All versions