CVE-2016-10735

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

CVSS v3.0 NVD

6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

4.04% chance of exploitation in the next 30 days, 91st percentile

Published

2019-01-09

Updated

2024-08-06

Proof-of-concept exploits (2)

• Yumeae/Bootstrap-with-XSS4★ · 2025-08-21
• ossf-cve-benchmark/CVE-2016-107350★ · 2020-12-01

Security advisories

• https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0
• twbs/bootstrap/issues/20184
• advisories/GHSA-4p24-vmcr-4gqj

References

• CVE Record
• NVD entry

Related

• CVE-2018-14040
• CVE-2019-8331
• CVE-2024-6485