CVE-2016-2046

MEDIUM 6.1CVE-2016-2046 · Published 17/02/2016 · updated 17/06/2026

In short

CVE-2016-2046 is a MEDIUM (CVSS 6.1) vulnerability affecting unified threat management software (sophos).
Chance of exploitation in the next 30 days (EPSS): 2.8%, higher than 86.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
unified threat management software sophos	`≤ 9.351`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in the UserPortal page in SOPHOS UTM before 9.353 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

References

packetstormsecurity.com/files/135709/Sophos-UTM-9-Cross-Site-Scripting.html · Exploit
seclists.org/fulldisclosure/2016/Feb/60 · Exploit
halock.com/blog/cve-2016-2046-cross-site-scripting-sophos-utm-9 · Exploit
securitytracker.com/id/1035048 · Third Party Advisory

More vulnerabilities in unified threat management software

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

unified threat management software

sophos

≤ 9.351

No fix yet

More vulnerabilities in unified threat management software

See all →