CVSS 3.0
6.1 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2016-10735
In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.
Severity
- EPSS
- 4.0% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- getbootstrap:bootstrap
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4p24-vmcr-4gqj | npm | bootstrap | >=2.0.4 <3.4.0 | 3.4.0 |
| GHSA-4p24-vmcr-4gqj | npm | bootstrap | >=4.0.0-beta <4.0.0-beta.2 | 4.0.0-beta.2 |
| GHSA-4p24-vmcr-4gqj | Maven | org.webjars:bootstrap | >=2.0.4 <3.4.0 | 3.4.0 |
| GHSA-4p24-vmcr-4gqj | Maven | org.webjars:bootstrap | >=4.0.0-beta <4.0.0-beta.2 | 4.0.0-beta.2 |
| GHSA-4p24-vmcr-4gqj | RubyGems | bootstrap | <4.0.0-beta.2 | 4.0.0-beta.2 |
| GHSA-4p24-vmcr-4gqj | Packagist | twbs/bootstrap | >=2.0.4 <3.4.0 | 3.4.0 |
| GHSA-4p24-vmcr-4gqj | Packagist | twbs/bootstrap | >=4.0.0-beta <4.0.0-beta.2 | 4.0.0-beta.2 |
| GHSA-4p24-vmcr-4gqj | NuGet | bootstrap | >=2.0.4 <3.4.0 | 3.4.0 |
| GHSA-4p24-vmcr-4gqj | NuGet | bootstrap | >=4.0.0-beta <4.0.0-beta.2 | 4.0.0-beta.2 |
| GHSA-4p24-vmcr-4gqj | npm | bootstrap-sass | >=2.0.4 <3.4.0 | 3.4.0 |
| GHSA-4p24-vmcr-4gqj | RubyGems | bootstrap-sass | >=2.0.4 <3.4.0 | 3.4.0 |
| GHSA-4p24-vmcr-4gqj | NuGet | bootstrap.sass | >=4.0.0-beta <4.0.0-beta.2 | 4.0.0-beta.2 |