### [CVE-2015-9251](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9251)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

### POC

#### Reference
- http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
- http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
- http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
- http://seclists.org/fulldisclosure/2019/May/13
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://github.com/jquery/jquery/pull/2588
- https://github.com/jquery/jquery/pull/2588/commits/c254d308a7d3f1eac4d0b42837804cfffcba4bb2
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
- https://seclists.org/bugtraq/2019/May/18
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.tenable.com/security/tns-2019-08

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/HansUXdev/OneArizona
- https://github.com/andrew-healey/canvas-lms-vuln
- https://github.com/andrew-healey/canvas-xss-poc
- https://github.com/catdever/watchdog
- https://github.com/ctcpip/jquery-security
- https://github.com/eotssa/ChromeScope
- https://github.com/faizhaffizudin/Case-Study-Hamsa
- https://github.com/flipkart-incubator/watchdog
- https://github.com/flyher/sheep
- https://github.com/halkichi0308/CVE-2015-9251
- https://github.com/octane23/CASE-STUDY-1
- https://github.com/rohankumardubey/watchdog
- https://github.com/sho-h/pkgvulscheck
- https://github.com/zema1/oracle-vuln-crawler