CVE-2016-9757

MEDIUM 5.4CVE-2016-9757 · Published 20/12/2016 · updated 17/06/2026

In short

CVE-2016-9757 is a MEDIUM (CVSS 5.4) vulnerability affecting nexpose (rapid7).
Chance of exploitation in the next 30 days (EPSS): 0.65%, higher than 50.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
nexpose rapid7	`= 6.4.12`	No fix yet

Description

In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags can inject cross-site scripting (XSS) elements in the tag name field. Once this tag is viewed in the Tag Detail page of the Rapid7 Nexpose 6.4.12 UI by another authenticated user, the script is run in that user's browser context.

References

securityfocus.com/bid/94996 · Third Party Advisory
help.rapid7.com/nexpose/en-us/release-notes · Vendor Advisory

More vulnerabilities in nexpose

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

nexpose

rapid7

= 6.4.12

No fix yet

Description

More vulnerabilities in nexpose

See all →