{"id":"CVE-2020-6159","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-6159","generatedAt":"2026-10-28T06:35:04.783Z","title":"URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scripting (XSS) attacks, but in certain circumstances this removal was not performed.","description":"URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scripting (XSS) attacks, but in certain circumstances this removal was not performed. This could allow users to be socially engineered to run an XSS attack against themselves. This vulnerability affects Opera for Android versions below 61.0.3076.56532.","published":"2020-12-23T16:15:13.000Z","lastModified":"2026-06-17T03:22:48.000Z","status":"Modified","sourceIdentifier":"security@opera.com","cvss":{"version":"3.1","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["opera/opera"],"epss":{"score":0.00641,"percentile":0.5053,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.64%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://security.opera.com/cross-site-scripting-in-ofa-opera-security-advisories/","tags":["Vendor Advisory"],"source":"security@opera.com"},{"url":"https://security.opera.com/cross-site-scripting-in-ofa-opera-security-advisories/","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-6159","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}