CVE-2016-20098
Last modified
CVE-2016-20098 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module, which inserts subreddit toolbox wiki fields into popup HTML without encoding. Attackers who can edit the toolbox wiki page can plant JavaScript in fields like pmsubject, header, or reason titles to act with moderators' Reddit sessions..
Description
Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module, which inserts subreddit toolbox wiki fields into popup HTML without encoding. Attackers who can edit the toolbox wiki page can plant JavaScript in fields like pmsubject, header, or reason titles to act with moderators' Reddit sessions.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| toolbox-team | reddit-moderator-toolbox | < 4.0.14 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2016-20098?
How severe is CVE-2016-20098?
How do I fix CVE-2016-20098?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2016
- CVE-2016-20092NetDrive 2.6.12 contains an unquoted service path vulnerabil…7.8
- CVE-2016-20093Wise Care 365 4.27 and Wise Disk Cleaner 9.29 contain unquot…7.8
- CVE-2016-20094AnyDesk 2.5.0 contains an unquoted service path vulnerabilit…7.8
- CVE-2016-20095Matrix42 Remote Control Host 3.20.0031 contains an unquoted …7.8
- CVE-2016-20096Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain …9.8
- CVE-2016-20097Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulner…7.5
- CVE-2016-20099L-SMASH through 2.14.5 contains an infinite loop vulnerabili…5.5
- CVE-2016-2010Cross-site scripting (XSS) vulnerability in HPE Network Node…
- CVE-2016-20100Memphis Documents Library plugin for WordPress before 3.1.6 …7.5
- CVE-2016-20101Issuu Panel plugin for WordPress before 1.6.6 contains a PHP…8.1
- CVE-2016-20102JavaMelody before 1.60.0 contains a reflected cross-site scr…6.1
- CVE-2016-20103Cherry Plugin for WordPress before 1.2.7 contains a path tra…7.5
Are you affected by CVE-2016-20098?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST