CVE-2016-9757

5.4 mediumEPSS 0.6%

In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags can inject cross-site scripting (XSS) elements in the tag name field. Once this tag is viewed in the Tag Detail page of the Rapid7 Nexpose 6.4.12 UI by another authenticated user, the script is run in that user's browser context.

Severity

CVSS 3.0

5.4 medium

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2016-12-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

rapid7:nexpose

References

http://www.securityfocus.com/bid/94996
https://help.rapid7.com/nexpose/en-us/release-notes/#6.4.13
http://www.securityfocus.com/bid/94996
https://help.rapid7.com/nexpose/en-us/release-notes/#6.4.13

Check your stack JSON