CVE-2016-10735

MEDIUM

Bootstrap 3.x < 3.4.0 and 4.x-beta < 4.0.0-beta.2 - Cross-Site Scripting via data-target Attribute

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-10735. PoCs published by Yumeae.

AI-analyzed exploit summary This repository contains a static HTML file demonstrating multiple Bootstrap XSS vulnerabilities, including CVE-2019-8331, which exploits the Tooltip component's `data-template` attribute. It is designed for educational purposes and requires manual version switching to test different vulnerabilities.

Description

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

Exploits (1)

nomisec WORKING POC 3 stars
by Yumeae · poc
https://github.com/Yumeae/Bootstrap-with-XSS

This repository contains a static HTML file demonstrating multiple Bootstrap XSS vulnerabilities, including CVE-2019-8331, which exploits the Tooltip component's `data-template` attribute. It is designed for educational purposes and requires manual version switching to test different vulnerabilities.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Bootstrap v4.x < v4.3.1 and v3.x < v3.4.1
No auth needed
Prerequisites: A browser to open the HTML file · Manual editing of the HTML file to switch Bootstrap versions
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (13)

Core 13
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906
Third Party Advisory x_refsource_misc
https://github.com/twbs/bootstrap/pull/26460
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/twbs/bootstrap/issues/20184
Patch, Third Party Advisory x_refsource_misc
https://github.com/twbs/bootstrap/pull/23687
Third Party Advisory x_refsource_misc
https://github.com/twbs/bootstrap/pull/23679
Release Notes, Third Party Advisory x_refsource_misc
https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:1456
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHBA-2019:1076
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHBA-2019:1570
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3023
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2020:0132
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2020:0133
Third Party Advisory x_refsource_confirm
https://www.tenable.com/security/tns-2021-14

Scores

CVSS v3 6.1
EPSS 0.0534
EPSS Percentile 90.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (10)
getbootstrap/bootstrap 4.0.0 beta
getbootstrap/bootstrap 3.0.0 - 3.4.0
npm/bootstrap 2.0.4 - 3.4.0npm
npm/bootstrap-sass 2.0.4 - 3.4.0npm
nuget/bootstrap 2.0.4 - 3.4.0NuGet
nuget/bootstrap.sass 4.0.0-beta - 4.0.0-beta.2NuGet
org.webjars/bootstrap 2.0.4 - 3.4.0Maven
rubygems/bootstrap 0 - 4.0.0-beta.2RubyGems
rubygems/bootstrap-sass 2.0.4 - 3.4.0RubyGems
twbs/bootstrap 2.0.4 - 3.4.0Packagist
Published Jan 09, 2019
Tracked Since Feb 18, 2026