CVE-2016-9757

In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags can inject cross-site scripting (XSS) elements in the tag name field. Once this tag is viewed in the Tag Detail page of the Rapid7 Nexpose 6.4.12 UI by another authenticated user, the script is run in that user's browser context.

• CWE-79

• http://www.securityfocus.com/bid/94996Third Party Advisory, VDB Entry
• https://help.rapid7.com/nexpose/en-us/release-notes/#6.4.13Vendor Advisory
• http://www.securityfocus.com/bid/94996Third Party Advisory, VDB Entry
• https://help.rapid7.com/nexpose/en-us/release-notes/#6.4.13Vendor Advisory

Published

Dec 20, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9750IBM QRadar 7.2 and 7.3 stores user credentials in plain in c…
• CVE-2016-9751Cross-site scripting (XSS) vulnerability in the search resul…
• CVE-2016-9752In Serendipity before 2.0.5, an attacker can bypass SSRF pro…
• CVE-2016-9754The ring_buffer_resize function in kernel/trace/ring_buffer.…7.8
• CVE-2016-9755The netfilter subsystem in the Linux kernel before 4.9 misha…
• CVE-2016-9756arch/x86/kvm/emulate.c in the Linux kernel before 4.8.12 doe…
• CVE-2016-9758Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9759Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9760Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9761Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9762Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9763Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…