CVEs-PoC/2020/CVE-2020-28487.md

### [CVE-2020-28487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28487)
![](https://img.shields.io/static/v1?label=Product&message=vis-timeline&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%207.4.4%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross-site%20Scripting%20(XSS)&color=brighgreen)

### Description

This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application.

### POC

#### Reference
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBVISJS-1063502
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1063501
- https://snyk.io/vuln/SNYK-JS-VISTIMELINE-1063500

#### Github
No PoCs found on GitHub currently.