NetSight
IP …
medium6.1Public exploit code

CVE-2014-3146

Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.

Affected products

VendorProductAffected versions
LxmlLxml
through 3.3.4
Versions 0.5, 0.5.1, 0.6, 0.7, 0.8

Weakness classification

CWE-79

References