CVE-2016-10735

MEDIUM

Bootstrap < 3.4.0 - XSS

Title source: rule

Description

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

Exploits (1)

nomisec WORKING POC 3 stars
by Yumeae · poc
https://github.com/Yumeae/Bootstrap-with-XSS

References (13)

Scores

CVSS v3 6.1
EPSS 0.0604
EPSS Percentile 90.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE
CWE-79
Status published

Affected Products (10)

getbootstrap/bootstrap < 3.4.0
getbootstrap/bootstrap
npm/bootstrap < 3.4.0npm
org.webjars/bootstrap < 3.4.0Maven
rubygems/bootstrap < 4.0.0-beta.2RubyGems
twbs/bootstrap < 3.4.0Packagist
nuget/bootstrap < 3.4.0NuGet
npm/bootstrap-sass < 3.4.0npm
rubygems/bootstrap-sass < 3.4.0RubyGems
nuget/bootstrap.sass < 4.0.0-beta.2NuGet

Timeline

Published Jan 09, 2019
Tracked Since Feb 18, 2026