CVE-2016-10510

Cross-site scripting (XSS) vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary web script or HTML by bypassing the strip_image_tags protection mechanism in system/classes/Kohana/Security.php.

• CWE-79

• https://advisory.checkmarx.net/advisory/CX-2016-4451
• https://github.com/kohana/kohana/issues/107Exploit, Patch, Third Party Advisory
• https://github.com/kohana/kohana/releases/tag/v3.3.6Release Notes, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/01/msg00015.htmlMailing List, Third Party Advisory
• https://www.checkmarx.com/advisories/cross-site-scripting-xss-vulnerability-in-kohana/Exploit, Third Party Advisory
• https://advisory.checkmarx.net/advisory/CX-2016-4451
• https://github.com/kohana/kohana/issues/107Exploit, Patch, Third Party Advisory
• https://github.com/kohana/kohana/releases/tag/v3.3.6Release Notes, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/01/msg00015.htmlMailing List, Third Party Advisory
• https://www.checkmarx.com/advisories/cross-site-scripting-xss-vulnerability-in-kohana/Exploit, Third Party Advisory

Published

Aug 31, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-10505NULL pointer dereference vulnerabilities in the imagetopnm f…
• CVE-2016-10506Division-by-zero vulnerabilities in the functions opj_pi_nex…
• CVE-2016-10507Integer overflow vulnerability in the bmp24toimage function …
• CVE-2016-10508Multiple cross-site scripting (XSS) vulnerabilities in phpTh…
• CVE-2016-10509SQL injection vulnerability in the updateAmazonOrderTracking…
• CVE-2016-1051Use-after-free vulnerability in Adobe Reader and Acrobat bef…
• CVE-2016-10511The Twitter iOS client versions 6.62 and 6.62.1 fail to vali…
• CVE-2016-10512MultiTech FaxFinder before 4.1.2 stores Passwords unencrypte…
• CVE-2016-10513Cross Site Scripting (XSS) exists in Piwigo before 2.8.3 via…
• CVE-2016-10514url_check_format in include/functions.inc.php in Piwigo befo…
• CVE-2016-10515In Redmine before 3.2.3, there are stored XSS vulnerabilitie…
• CVE-2016-10516Cross-site scripting (XSS) vulnerability in the render_full …