CVE-2016-2046: sophos unified_threat_management_software Cross-site Scripting
Vulnerability summary
CVE-2016-2046 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in sophos unified_threat_management_software. EPSS estimates a 2.77% chance of exploitation in the next 30 days, higher than 86.1% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 17-02-2016PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Cross-site scripting (XSS) vulnerability in the UserPortal page in SOPHOS UTM before 9.353 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.77%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
0.00 pp
From 2.77% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (halock.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Sophos1 product
1 vendor · 1 product
References
4 links- packetstormsecurity.com/files/135709/Sophos-UTM-9-Cross-Site-Scripting.htmlX Refsource MISCExploitThird Party Advisory
- www.halock.com/blog/cve-2016-2046-cross-site-scripting-sophos-utm-9/X Refsource MISCExploitThird Party Advisory