CVE-2016-6127

6.1 mediumEPSS 1.2%

Medium (6.1) in bestpractical request tracker. EPSS 1.2% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified content type.

Severity

CVSS 3.0

6.1 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2017-07-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

bestpractical:request_tracker

References

http://www.debian.org/security/2017/dsa-3882
http://www.securityfocus.com/bid/99375
https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016
http://www.debian.org/security/2017/dsa-3882
http://www.securityfocus.com/bid/99375

Check your stack JSON