WaratekVRT Sign in

CVE-2015-9251 jQuery

Affected softwarejQuery
Severity6.1 Medium CVSS 3.0 2 scores
WeaknessCross-site scripting (CWE-79)
Published18 Jan 2018
Updated17 Jun 2026

Description

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 2 citations · 4 exploits · earliest 2021-01-21.
  • CISA Vulnrichment no assessment published
  • Indexed PoC 4 indexed Published artifacts you can open, in GitHub PoC; first seen 2018-12-20.
  • EPSS 30% chance in 30 days A model's forecast, not a report of exploitation. Higher than 98% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2015-9251 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation tenable.com /blog/daisy-chaining-how-vulnerabilities-can-be-greater-than-the-sum-of-their-parts 2021-01-21
Reported exploitation securin.io /wp-content/uploads/2023/08/2023-State-of-Cybersecurity-for-Medical-Devices-and-Healthcare-Systems.pdf 2023-08-08
Exploit reference VulnCheck XDB 381aa158770e Exploit type: client-side 2018-12-20
Exploit reference VulnCheck XDB 4880bf89722a Exploit type: client-side 2024-11-01
Exploit reference VulnCheck XDB f369e87c8fdd Exploit type: client-side 2025-01-08
Exploit reference VulnCheck XDB f57a9b0742b1 Exploit type: client-side 2025-09-02

3 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC halkichi0308/CVE-2015-9251 9 2018-12-20
GitHub PoC This repository contains a Proof of Concept (PoC) for CVE-2015-9251, a vulnerability in jQuery versions prior to 3.0.0 that allows attackers to perform Cross-Site Scripting (XSS) attacks under certain conditions. 2 2025-01-08
GitHub PoC PoC para CVE-2015-9251 jQuery menor a 3.0.0. 2 2024-11-01
GitHub PoC cve-2015-9251 2025-06-06

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

6.1 MEDIUM v3.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 6.1 MEDIUM CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N NVD Primary published
CVSS 2.0 4.3 none AV:N/AC:M/Au:N/C:N/I:P/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2020 ↗ CPU 2020-Q3 Oracle Retail Applications / Promotions (jQuery) (18.0)
Oracle Critical Patch Update April 2020 ↗ CPU 2020-Q2 Oracle Knowledge / Information Manager Console, Web Applications - InfoCenter (jQuery) (8.6.0-8.6.3)
Oracle Critical Patch Update October 2019 ↗ CPU 2019-Q4 Oracle Fusion Middleware / Web Services (jQuery) (12.1.3.0.0, 12.2.1.3.0)
Oracle Critical Patch Update July 2019 ↗ CPU 2019-Q3 Oracle Communications Applications / Security (jQuery) (3.7.1, 3.8.0)
Oracle Construction and Engineering Suite / Core (jQuery) (16.1, 16.2, 17.7-17.12, 18.8)
Oracle Fusion Middleware / BI Platform Security (jQuery) (11.1.1.9.0, 12.2.1.4.0)
Oracle Support Tools / Libraries (Jsch and jQuery) (Prior to 2.12.36)
Oracle Critical Patch Update April 2019 ↗ CPU 2019-Q2 Oracle Communications Applications / Security (jQuery) (3.4, 4.0)
Oracle Communications Applications / Security (jQuery) (6.0, 6.1, 6.2)
Oracle Financial Services Applications / Internal Operations (jQuery) (8.0.2-8.0.6)
Oracle Financial Services Applications / User Interface (jQuery) (7.3.3-7.3.5, 8.0.0-8.0.7)
Oracle Financial Services Applications / User Interface (jQuery) (8.0.2-8.0.7)
Oracle Financial Services Applications / User Interface (jQuery) (8.0.4-8.0.6)
Oracle Financial Services Applications / User Interface (jQuery) (8.0.4-8.0.7)
Oracle Financial Services Applications / User Interface (jQuery) (8.0.4-8.0.7)
Oracle Financial Services Applications / User Interface (jQuery) (8.0.4-8.0.7)
Oracle Financial Services Applications / User Interface (jQuery) (8.0.5, 8.0.6)
Oracle Financial Services Applications / User Interface (jQuery) (8.0.5, 8.0.6)
Oracle Financial Services Applications / User Interface (jQuery) (8.0.5-8.0.7)
Oracle Food and Beverage Applications / Oracle Hospitality Reporting and Analytics (9.1.0)
Oracle Fusion Middleware / ADF Faces (jQuery) (11.1.1.9.0, 12.1.3.0.0, 12.2.1.3.0)
Oracle Fusion Middleware / Install (jQuery) (12.2.1.3.0)
Oracle JD Edwards Products / Web Runtime (jQuery) (9.2)
Oracle Retail Applications / General (jQuery) (15.0.2)
Oracle Retail Applications / Security (jQuery) (15.0)
Oracle Support Tools / Remote Diagnostic Agent (jQuery) (19.1)
Oracle Utilities Applications / Mobile Platform (jQuery) (2.3.0)
Oracle Utilities Applications / Mobile Platform (jQuery) (2.3.0)
Oracle Critical Patch Update January 2019 ↗ CPU 2019-Q1 Oracle Communications Applications / Security (JQuery) (prior to 7.0.0.1)
Oracle Communications Applications / Security (jQuery) (prior to 7.2)
Oracle Enterprise Manager Products Suite / Networking (jQuery) (12.2.2, 12.3.3)
Oracle Fusion Middleware / Runtime Engine (JQuery) (11.1.1.9.0, 12.1.3.0.0, 12.2.1.3.0)
Oracle Fusion Middleware / Sample apps (jQuery) (12.1.3.0, 12.2.1.3)
Oracle Health Sciences Applications / Install (jQuery) (7.1, 7.2)
Oracle Insurance Applications / Framework (jQuery) (5.2, 5.4, 5.5)
Oracle PeopleSoft Products / Mobile Application Platform (jQuery) (8.55, 8.56, 8.57)
Oracle Retail Applications / Framework (jQuery) (1.60.9, 1.64.0)
Oracle Retail Applications / Operational Insights (jQuery) (15.0)
Oracle Retail Applications / Other (jQuery) (15.0, 16.0)
Oracle Supply Chain Products Suite / Supplier Portal (jQuery) (6.2.0.0, 6.2.1.0, 6.2.2.0, 6.2.3.0, 6.2.3.1)
Oracle Utilities Applications / User Interface (jQuery) (4.3.0.1-4.3.0.4)
Oracle Critical Patch Update October 2018 ↗ CPU 2018-Q4 Oracle Construction and Engineering Suite / Admin (jQuery) (15.2, 16.2, 17.12)
Oracle Financial Services Applications / UI (jQuery) (2.6.0, 2.6.1, 2.6.2)
Oracle Food and Beverage Applications / Oracle Hospitality Materials Control (18.1)
Oracle Fusion Middleware / Advanced UI (jQuery) (11.1.1.8.0)
Oracle Fusion Middleware / OSB Core Functionality (jQuery) (12.1.3.0.0, 12.2.1.3.0)
Oracle Fusion Middleware / Studio (jQuery) (3.1.0, 3.2.0)
Oracle Health Sciences Applications / Cohort Explorer (jQuery) (3.1.0)
Oracle Hospitality Applications / Base (jQuery) (4.2.0, 4.2.1)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Applications Security (JQuery) prior to 7.0.0.1
Oracle Communications Applications Security (jQuery) prior to 7.2 3.4 · 3.7.1 · 3.8.0 · 4.0 · 6.0 · 6.1 · 6.2
Oracle Construction and Engineering Suite Admin (jQuery) 15.2, 16.2, 17.12 15.2 · 16.2 · 17.12
Oracle Construction and Engineering Suite Core (jQuery) 16.1, 16.2, 17.7-17.12, 18.8 16.1 · 16.2 · 18.8
Oracle Enterprise Manager Products Suite Networking (jQuery) 12.2.2, 12.3.3 12.2.2 · 12.3.3
Oracle Financial Services Applications Internal Operations (jQuery) 8.0.2-8.0.6
Oracle Financial Services Applications UI (jQuery) 2.6.0, 2.6.1, 2.6.2 2.6.0 · 2.6.1 · 2.6.2
Oracle Financial Services Applications User Interface (jQuery) 7.3.3-7.3.5, 8.0.0-8.0.7 8.0.5 · 8.0.6
Oracle Food and Beverage Applications Oracle Hospitality Materials Control 18.1 18.1
Oracle Food and Beverage Applications Oracle Hospitality Reporting and Analytics 9.1.0 9.1.0
Oracle Fusion Middleware ADF Faces (jQuery) 11.1.1.9.0, 12.1.3.0.0, 12.2.1.3.0 11.1.1.9.0 · 12.1.3.0.0 · 12.2.1.3.0
Oracle Fusion Middleware Advanced UI (jQuery) 11.1.1.8.0 11.1.1.8.0
Oracle Fusion Middleware BI Platform Security (jQuery) 11.1.1.9.0, 12.2.1.4.0 11.1.1.9.0 · 12.2.1.4.0
Oracle Fusion Middleware Install (jQuery) 12.2.1.3.0 12.2.1.3.0
Oracle Fusion Middleware OSB Core Functionality (jQuery) 12.1.3.0.0, 12.2.1.3.0 12.1.3.0.0 · 12.2.1.3.0
Oracle Fusion Middleware Runtime Engine (JQuery) 11.1.1.9.0, 12.1.3.0.0, 12.2.1.3.0 11.1.1.9.0 · 12.1.3.0.0 · 12.2.1.3.0
Oracle Fusion Middleware Sample apps (jQuery) 12.1.3.0, 12.2.1.3 12.1.3.0 · 12.2.1.3
Oracle Fusion Middleware Studio (jQuery) 3.1.0, 3.2.0 3.1.0 · 3.2.0
Oracle Fusion Middleware Web Services (jQuery) 12.1.3.0.0, 12.2.1.3.0 12.1.3.0.0 · 12.2.1.3.0
Oracle Health Sciences Applications Cohort Explorer (jQuery) 3.1.0 3.1.0
Oracle Health Sciences Applications Install (jQuery) 7.1, 7.2 7.1 · 7.2
Oracle Hospitality Applications Base (jQuery) 4.2.0, 4.2.1 4.2.0 · 4.2.1
Oracle Insurance Applications Framework (jQuery) 5.2, 5.4, 5.5 5.2 · 5.4 · 5.5
Oracle JD Edwards Products Web Runtime (jQuery) 9.2 9.2
Oracle Knowledge Information Manager Console, Web Applications - InfoCenter (jQuery) 8.6.0-8.6.3
Oracle PeopleSoft Products Mobile Application Platform (jQuery) 8.55, 8.56, 8.57 8.55 · 8.56 · 8.57
Oracle Retail Applications Framework (jQuery) 1.60.9, 1.64.0 1.60.9 · 1.64.0
Oracle Retail Applications General (jQuery) 15.0.2 15.0.2
Oracle Retail Applications Operational Insights (jQuery) 15.0 15.0
Oracle Retail Applications Other (jQuery) 15.0, 16.0 15.0 · 16.0
Oracle Retail Applications Promotions (jQuery) 18.0 18.0
Oracle Retail Applications Security (jQuery) 15.0 15.0
Oracle Supply Chain Products Suite Supplier Portal (jQuery) 6.2.0.0, 6.2.1.0, 6.2.2.0, 6.2.3.0, 6.2.3.1 6.2.0.0 · 6.2.1.0 · 6.2.2.0 · 6.2.3.0 · 6.2.3.1
Oracle Support Tools Libraries (Jsch and jQuery) Prior to 2.12.36
Oracle Support Tools Remote Diagnostic Agent (jQuery) 19.1 19.1
Oracle Utilities Applications Mobile Platform (jQuery) 2.3.0 2.3.0
Oracle Utilities Applications User Interface (jQuery) 4.3.0.1-4.3.0.4

Products and versions

47 products, 81 version entries
SourceVendorProductSchemeAffected versions
nvd jquery jquery generic ＜ 3.0.0
nvd oracle agile product lifecycle management for process generic 6.2.0.0 · 6.2.1.0 · 6.2.2.0 · 6.2.3.0 · 6.2.3.1
nvd oracle banking platform generic 2.6.0 · 2.6.1 · 2.6.2
nvd oracle business process management suite generic 11.1.1.9.0 · 12.1.3.0.0 · 12.2.1.3.0
nvd oracle communications converged application server generic ＜ 7.0.0.1
nvd oracle communications interactive session recorder generic 6.0 · 6.1 · 6.2
nvd oracle communications services gatekeeper generic ＜ 6.1.0.4.0
nvd oracle communications webrtc session controller generic ＜ 7.2
nvd oracle endeca information discovery studio generic 3.1.0 · 3.2.0
nvd oracle enterprise manager ops center generic 12.2.2 · 12.3.3
nvd oracle enterprise operations monitor generic 3.4 · 4.0
nvd oracle financial services analytical applications infrastructure generic ≥ 7.3.3 and ≤ 7.3.5 · ≥ 8.0.0 and ≤ 8.0.7
nvd oracle financial services asset liability management generic ≥ 8.0.4 and ≤ 8.0.7
nvd oracle financial services data integration hub generic ≥ 8.0.5 and ≤ 8.0.7
nvd oracle financial services funds transfer pricing generic ≥ 8.0.4 and ≤ 8.0.7
nvd oracle financial services hedge management and ifrs valuations generic ≥ 8.0.4 and ≤ 8.0.7
nvd oracle financial services liquidity risk management generic ≥ 8.0.2 and ≤ 8.0.6
nvd oracle financial services loan loss forecasting and provisioning generic ≥ 8.0.2 and ≤ 8.0.7
nvd oracle financial services market risk measurement and management generic 8.0.5 · 8.0.6
nvd oracle financial services profitability management generic ≥ 8.0.4 and ≤ 8.0.6
nvd oracle financial services reconciliation framework generic 8.0.5 · 8.0.6
nvd oracle fusion middleware mapviewer generic 12.2.1.3.0
nvd oracle healthcare foundation generic 7.1 · 7.2
nvd oracle healthcare translational research generic 3.1.0
nvd oracle hospitality cruise fleet management generic 9.0.11
nvd oracle hospitality guest access generic 4.2.0 · 4.2.1
nvd oracle hospitality materials control generic 18.1
nvd oracle hospitality reporting and analytics generic 9.1.0
nvd oracle insurance insbridge rating and underwriting generic 5.2 · 5.4 · 5.5
nvd oracle jd edwards enterpriseone tools generic 9.2
nvd oracle jdeveloper generic 11.1.1.9.0 · 12.1.3.0.0 · 12.2.1.3.0
nvd oracle oss support tools generic 19.1
nvd oracle peoplesoft enterprise peopletools generic 8.55 · 8.56 · 8.57
nvd oracle primavera gateway generic 15.2 · 16.2 · 17.12
nvd oracle primavera unifier generic 16.1 · 16.2 · ≥ 17.1 and ≤ 17.12 · 18.8
nvd oracle real-time scheduler generic 2.3.0
nvd oracle retail allocation generic 15.0.2
nvd oracle retail customer insights generic 15.0 · 16.0
nvd oracle retail invoice matching generic 15.0
nvd oracle retail sales audit generic 15.0
nvd oracle retail workforce management software generic 1.60.9 · 1.64.0
nvd oracle service bus generic 12.1.3.0.0 · 12.2.1.3.0
nvd oracle siebel ui framework generic 18.10 · 18.11
nvd oracle utilities framework generic ≥ 4.3.0.1 and ≤ 4.3.0.4
nvd oracle utilities mobile workforce management generic 2.3.0
nvd oracle webcenter sites generic 11.1.1.8.0
nvd oracle weblogic server generic 12.1.3.0 · 12.2.1.3

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** BI PLATFORM SECURITY (JQUERY), MOBILE APPLICATION PLATFORM (JQUERY), NO AUTH REMOTE EXPLOIT, INTERNAL OPERATIONS (JQUERY), STUDIO (JQUERY), OSB CORE FUNCTIONALITY (JQUERY), SECURITY (JQUERY), SAMPLE APPS (JQUERY), REMOTE DIAGNOSTIC AGENT (JQUERY), BASE (JQUERY), INFORMATION MANAGER CONSOLE, OTHER (JQUERY), GENERAL (JQUERY), HTTP, SUPPLIER PORTAL (JQUERY), REPORT (JQUERY), WEB APPLICATIONS - INFOCENTER (JQUERY), WEB RUNTIME (JQUERY), LIBRARIES (JSCH AND JQUERY), MOBILEAUTHWEBSERVICE (JQUERY), INSTALL (JQUERY), MULTIPLE, NETWORKING (JQUERY), ADMIN (JQUERY), ADF FACES (JQUERY), CORE (JQUERY), RUNTIME ENGINE (JQUERY), ADVANCED UI (JQUERY), UI (JQUERY), WEB SERVICES (JQUERY), FRAMEWORK (JQUERY), OPERATIONAL INSIGHTS (JQUERY), MOBILE PLATFORM (JQUERY), PROMOTIONS (JQUERY), USER INTERFACE (JQUERY), COHORT EXPLORER (JQUERY) **Products:** ORACLE COMMUNICATIONS CONVERGED APPLICATION SERVER, PRIMAVERA UNIFIER, ORACLE SUPPORT TOOLS, ORACLE UTILITIES FRAMEWORK, ORACLE SERVICE BUS, ORACLE FINANCIAL SERVICES DATA INTEGRATION HUB, ORACLE FINANCIAL SERVICES APPLICATIONS, ENTERPRISE MANAGER OPS CENTER, ORACLE FINANCIAL SERVICES ANALYTICAL APPLICATIONS INFRASTRUCTURE, ORACLE WEBCENTER SITES, ORACLE COMMUNICATIONS APPLICATION SESSION CONTROLLER, ORACLE INSURANCE APPLICATIONS, ORACLE HOSPITALITY REPORTING AND ANALYTICS, ORACLE AGILE PRODUCT LIFECYCLE MANAGEMENT FOR PROCESS, ORACLE RETAIL CUSTOMER MANAGEMENT AND SEGMENTATION FOUNDATION, ORACLE COMMUNICATIONS INTERACTIVE SESSION RECORDER, ORACLE FINANCIAL SERVICES LOAN LOSS FORECASTING AND PROVISIONING, ORACLE REAL-TIME SCHEDULER, ORACLE FUSION MIDDLEWARE, ORACLE FINANCIAL SERVICES MARKET RISK MEASUREMENT AND MANAGEMENT, ORACLE RETAIL WORKFORCE MANAGEMENT SOFTWARE, ORACLE FINANCIAL SERVICES RECONCILIATION FRAMEWORK, OSS SUPPORT TOOLS, ORACLE INSURANCE INSBRIDGE RATING AND UNDERWRITING, ORACLE RETAIL CUSTOMER INSIGHTS, ORACLE SUPPLY CHAIN PRODUCTS SUITE, ORACLE FUSION MIDDLEWARE MAPVIEWER, ORACLE COMMUNICATIONS APPLICATIONS, ORACLE UTILITIES APPLICATIONS, ORACLE HEALTH SCIENCES APPLICATIONS, ORACLE ENTERPRISE MANAGER PRODUCTS SUITE, ORACLE JDEVELOPER, ORACLE FINANCIAL SERVICES PROFITABILITY MANAGEMENT, ORACLE BANKING PLATFORM, ORACLE COMMUNICATIONS WEBRTC SESSION CONTROLLER, ORACLE CONSTRUCTION AND ENGINEERING SUITE, ORACLE HOSPITALITY GUEST ACCESS, ORACLE RETAIL APPLICATIONS, ORACLE FINANCIAL SERVICES ASSET LIABILITY MANAGEMENT, ORACLE HOSPITALITY MATERIALS CONTROL, ORACLE FINANCIAL SERVICES FUNDS TRANSFER PRICING, DIAGNOSTIC ASSISTANT, ORACLE HEALTHCARE TRANSLATIONAL RESEARCH, JS-JQUERY, ORACLE FINANCIAL SERVICES HEDGE MANAGEMENT AND IFRS VALUATIONS, ORACLE BUSINESS INTELLIGENCE ENTERPRISE EDITION, ORACLE JD EDWARDS PRODUCTS, ORACLE FOOD AND BEVERAGE APPLICATIONS, ORACLE RETAIL SALES AUDIT, ORACLE WEBLOGIC SERVER, ORACLE HEALTHCARE FOUNDATION, ORACLE FINANCIAL SERVICES LIQUIDITY RISK MANAGEMENT, PRIMAVERA GATEWAY, ORACLE KNOWLEDGE, ORACLE BUSINESS PROCESS MANAGEMENT SUITE, ORACLE HOSPITALITY APPLICATIONS, ORACLE ENTERPRISE OPERATIONS MONITOR, ORACLE UTILITIES MOBILE WORKFORCE MANAGEMENT, ORACLE PEOPLESOFT PRODUCTS, PEOPLESOFT ENTERPRISE PEOPLETOOLS, ORACLE RETAIL INVOICE MATCHING, ORACLE ENDECA INFORMATION DISCOVERY STUDIO, ORACLE RETAIL ALLOCATION, JD EDWARDS ENTERPRISEONE TOOLS

References

URLTags
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
http://seclists.org/fulldisclosure/2019/May/10
http://seclists.org/fulldisclosure/2019/May/11
http://seclists.org/fulldisclosure/2019/May/13
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch
http://www.securityfocus.com/bid/105658 Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2020:0481

Timeline
Published2018-01-18By the CVE Program.
VulnCheck KEV: earliest evidence2021-01-21Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
VulnCheck KEV: latest evidence2025-09-02Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-17NVD's own last-modified date for this record.