CVE-2016-8855

MEDIUM

Sitecore Experience Platform 8.1 - XSS

Title source: llm

Description

Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experience Platform 8.1 rev. 160519 (8.1 Update-3) allows remote attacks via the Name or Description parameter. This is fixed in 8.2 Update-2.

Exploits (1)

exploitdb WRITEUP

by Pralhad Chaskar · textwebappsaspx

https://www.exploit-db.com/exploits/41618

View Code ZIP pw:eip

References (2)

[Exploit, Third Party Advisory, VDB Entry] https://packetstormsecurity.com/files/141655/Sitecore-Experience-Platform-8.1-Update-3-Cross-Site-Scripting.html

[Exploit, Third Party Advisory, VDB Entry] https://www.exploit-db.com/exploits/41618/

Scores

CVSS v3 6.1

EPSS 0.0030

EPSS Percentile 52.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-79

Status published

Affected Products (2)

sitecore/experience_platform

n/a/n/a

Timeline

Published Mar 19, 2017

Tracked Since Feb 18, 2026