VulnerabilityModified
CVE-2016-10245
Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection.
MEDIUM 6.1EPSS 1.82%
Does this matter?
Lower severity and a low EPSS score (1.82%). Track it; it rarely justifies an emergency change on its own.
Description
Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection.
- CVSS 3.0
- 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.82% probability · 79th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- doxygen/doxygen
- Source
- cve@mitre.org
EPSS 1.8% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00000.html
- http://www.securityfocus.com/bid/108476Third Party Advisory, VDB Entry
- http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_12Broken Link
- https://bugzilla.gnome.org/show_bug.cgi?id=762934Issue Tracking, Third Party Advisory
- https://github.com/doxygen/doxygen/commit/1cc1adad2de03a0f013881b8960daf89aa155081Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00046.html
- https://usn.ubuntu.com/4002-1/
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00000.html
- http://www.securityfocus.com/bid/108476Third Party Advisory, VDB Entry
- http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_12Broken Link
- https://bugzilla.gnome.org/show_bug.cgi?id=762934Issue Tracking, Third Party Advisory
- https://github.com/doxygen/doxygen/commit/1cc1adad2de03a0f013881b8960daf89aa155081Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00046.html
- https://usn.ubuntu.com/4002-1/
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.