{"id":"CVE-2016-6365","aliases":["EUVD-2016-7288","GHSA-xr4r-mvww-q76g"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in Cisco Firepower Management Center 4.10.3, 5.2.0, 5.3...","description":"Cross-site scripting (XSS) vulnerability in Cisco Firepower Management Center 4.10.3, 5.2.0, 5.3.0, 5.3.0.2, 5.3.1, and 5.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCur25508 and CSCur25518.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0085,"percentile":0.58425,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2016-08-23T01:00:00Z","modified":"2026-06-17T00:50:54Z","products":[{"vendor":"cisco","product":"secure_firewall_management_center"}],"references":[{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-firepowermc","tags":["vendor-advisory","x_refsource_CISCO","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/92510","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6365"},{"url":"https://github.com/advisories/GHSA-xr4r-mvww-q76g"}],"sources":{"cve":[{"id":"CVE-2016-6365","description":"Cross-site scripting (XSS) vulnerability in Cisco Firepower Management Center 4.10.3, 5.2.0, 5.3.0, 5.3.0.2, 5.3.1, and 5.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCur25508 and CSCur25518.","status":"published","published":"2016-08-23T01:00:00Z","modified":"2024-08-06T01:29:19.14Z","updated_at":"2026-11-02T14:33:34.443637Z"}],"euvd":[{"id":"EUVD-2016-7288","description":"Cross-site scripting (XSS) vulnerability in Cisco Firepower Management Center 4.10.3, 5.2.0, 5.3.0, 5.3.0.2, 5.3.1, and 5.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCur25508 and CSCur25518.","status":"published","published":"2016-08-23T01:00:00Z","modified":"2024-08-06T01:29:19Z","updated_at":"2026-11-03T02:22:36.894057Z"}],"ghsa":[{"id":"GHSA-xr4r-mvww-q76g","title":"Cross-site scripting (XSS) vulnerability in Cisco Firepower Management Center 4.10.3, 5.2.0, 5.3...","description":"Cross-site scripting (XSS) vulnerability in Cisco Firepower Management Center 4.10.3, 5.2.0, 5.3.0, 5.3.0.2, 5.3.1, and 5.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCur25508 and CSCur25518.","status":"published","published":"2022-05-17T03:21:46Z","modified":"2023-01-27T05:08:01Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:43:13.955662Z"}],"nvd":[{"id":"CVE-2016-6365","description":"Cross-site scripting (XSS) vulnerability in Cisco Firepower Management Center 4.10.3, 5.2.0, 5.3.0, 5.3.0.2, 5.3.1, and 5.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCur25508 and CSCur25518.","status":"published","published":"2016-08-23T02:11:04.96Z","modified":"2026-06-17T00:50:54.06Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:28.854267Z"}]}}