CVE-2016-9757 json
In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags c…
published 2016-12-20 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-10558
- cvss
- 5.4
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags can inject cross-site scripting (XSS) elements in the tag name field. Once this tag is viewed in the Tag Detail page of the Rapid7 Nexpose 6.4.12 UI by another authenticated user, the script is run in that user's browser context.
Exploit prediction
0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
Affected products
- Rapid7 Nexpose
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
help.rapid7.com
/nexpose/en-us/release-notes/#6.4.13
vendor-advisory
-
securityfocus.com
/bid/94996
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2016-9757
- NVD CVE-2016-9757
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.