CVE-2016-10735

MEDIUM

Bootstrap < 3.4.0 - XSS

Title source: rule

Description

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

Exploits (1)

nomisec WORKING POC 3 stars
by Yumeae · poc
https://github.com/Yumeae/Bootstrap-with-XSS

References (13)

Scores

CVSS v3 6.1
EPSS 0.0675
EPSS Percentile 91.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (10)
getbootstrap/bootstrap 4.0.0 beta
getbootstrap/bootstrap 3.0.0 - 3.4.0
npm/bootstrap 2.0.4 - 3.4.0npm
npm/bootstrap-sass 2.0.4 - 3.4.0npm
nuget/bootstrap 2.0.4 - 3.4.0NuGet
nuget/bootstrap.sass 4.0.0-beta - 4.0.0-beta.2NuGet
org.webjars/bootstrap 2.0.4 - 3.4.0Maven
rubygems/bootstrap 0 - 4.0.0-beta.2RubyGems
rubygems/bootstrap-sass 2.0.4 - 3.4.0RubyGems
twbs/bootstrap 2.0.4 - 3.4.0Packagist
Published Jan 09, 2019
Tracked Since Feb 18, 2026