CVE-2016-6283

Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.10.6 allows remote attackers to inject arbitrary web script or HTML via the newFileName parameter to pages/doeditattachment.action.

• CWE-79

• http://packetstormsecurity.com/files/140363/Atlassian-Confluence-5.9.12-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2017/Jan/12Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2017/Jan/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/95288Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40989/Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/140363/Atlassian-Confluence-5.9.12-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2017/Jan/12Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2017/Jan/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/95288Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/40989/Third Party Advisory, VDB Entry

Published

Jan 18, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6270The handle_certificate function in /vmi/manager/engine/manag…8.8
• CVE-2016-6271The Bzrtp library (aka libbzrtp) 1.0.x before 1.0.4 allows m…
• CVE-2016-6272XPath injection vulnerability in Epic MyChart allows remote …
• CVE-2016-6273The lmadmin component in Flexera FlexNet Publisher (aka Flex…
• CVE-2016-6276Citrix Linux Virtual Delivery Agent (aka VDA, formerly Linux…
• CVE-2016-6277NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Bet…8.8
• CVE-2016-6285Cross-site scripting (XSS) vulnerability in includes/decorat…
• CVE-2016-6286The "spiffy-cgi-handlers" egg would convert a nonexistent "P…
• CVE-2016-6287The "http-client" egg always used a HTTP_PROXY environment v…
• CVE-2016-6288The php_url_parse_ex function in ext/standard/url.c in PHP b…
• CVE-2016-6289Integer overflow in the virtual_file_ex function in TSRM/tsr…
• CVE-2016-6290ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6…