CVE-2018-17886: Jeesns

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

An issue was discovered in JEESNS 1.3. The XSS filter in com.lxinet.jeesns.core.utils.XssHttpServletRequestWrapper.java could be bypassed, as demonstrated by a <svg/onLoad=confirm substring. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-12429.

Affected products

• Jeesns Jeesns: version 1.3 only

Published 2018-10-02. Last modified 2026-06-17.