CVE-2016-10245

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-05-24 · updated 2026-06-17
Weakness: CWE-79

Description

Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection.

Affected products

Doxygen: before 1.8.12 — fixed in 1.8.12

How to fix

Upgrade to a fixed version: Doxygen 1.8.12. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00000.html
http://www.securityfocus.com/bid/108476
http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_12
https://bugzilla.gnome.org/show_bug.cgi?id=762934
https://github.com/doxygen/doxygen/commit/1cc1adad2de03a0f013881b8960daf89aa155081
https://lists.debian.org/debian-lts-announce/2019/05/msg00046.html
https://usn.ubuntu.com/4002-1/
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00000.html
http://www.securityfocus.com/bid/108476
http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_12
https://bugzilla.gnome.org/show_bug.cgi?id=762934
https://github.com/doxygen/doxygen/commit/1cc1adad2de03a0f013881b8960daf89aa155081

Get alerted when CVE-2016-10245 or the next vulnerability affects your stack