CVE-2016-7251

MEDIUM

Microsoft SQL Server 2016 - Cross-Site Scripting in MDS API

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in the MDS API in Microsoft SQL Server 2016 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "MDS API XSS Vulnerability."

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1037250
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/94043

Scores

CVSS v3 6.1
EPSS 0.0819
EPSS Percentile 94.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
microsoft/sql_server 2016
Published Nov 10, 2016
Tracked Since Feb 18, 2026