CVE-2024-47075

DOM Clobbering gadgets found in layui that lead to Cross-site Scripting

LayUI is a native minimalist modular Web UI component library. Versions prior to 2.9.17 have a DOM Clobbering vulnerability that can lead to Cross-site Scripting (XSS) on web pages where attacker-controlled HTML elements (e.g., `img` tags with unsanitized `name` attributes) are present. Version 2.9.17 fixes this issue.

We have discovered 4,297 live websites that are affected by CVE-2024-47075.

Run a Free Instant Scan



Affected Software

Product  Layui
Category UI Frameworks
Vulnerable Domains4,297 live websites (94% of Layui install base)
Vulnerable Versions
  • from 0 through 2.9.17
Vulnerable Versions Count121 versions ( 81% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Sep 26, 2024
  • Updated - Sep 26, 2024

Website Distribution by Country

Number of websites using CVE-2024-47075
United States624 websites


China2,710 websites
Hong Kong307 websites
Singapore202 websites
Japan51 websites
Canada40 websites
GB22 websites
Taiwan22 websites
Brazil12 websites

Website Distribution by TLD

Number of websites using CVE-2024-47075
.com2,783 websites
.cn627 websites
.com.cn208 websites
.net191 websites
.org84 websites
.co5 websites
.com.au4 websites
.info4 websites
.fr3 websites
.jp2 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-47075

Top websites that are affected by CVE-2024-47075. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***********.com Singapore*,***
*****.com United States**,***
*****.********.com China**,***
****.com China**,***
*****.**.***.cn China***,***
****.cn China***,***
*****************.com United States***,***
******.com United States***,***
*******.com China***,***
******.com United States***,***
See full domain list

FAQ

CVE-2024-47075 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Layui
A total of 4,297 websites have been identified as vulnerable to CVE-2024-47075, based on global website indexing conducted by WebTechSurvey.
The Layui is affected by the CVE-2024-47075 vulnerability.
Layui versions up to 2.9.17 are vulnerable to CVE-2024-47075.
CVE-2024-47075 is resolved in version 2.9.17 of Layui.