CVE-2016-2862

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-07-03 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 before 7.0.0.9 cumulative iFix 3, and 8.0 before 8.0.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Affected products

IBM WebSphere Commerce Enterprise: 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.0.0.4, 6.0.0.5 (+21)

References

http://www-01.ibm.com/support/docview.wss?uid=swg1JR55049
http://www-01.ibm.com/support/docview.wss?uid=swg1JR55139
http://www-01.ibm.com/support/docview.wss?uid=swg1JR55141
http://www-01.ibm.com/support/docview.wss?uid=swg1JR55264
http://www-01.ibm.com/support/docview.wss?uid=swg21983625
http://www.securityfocus.com/bid/91533
http://www.securitytracker.com/id/1036206
http://www-01.ibm.com/support/docview.wss?uid=swg1JR55049
http://www-01.ibm.com/support/docview.wss?uid=swg1JR55139
http://www-01.ibm.com/support/docview.wss?uid=swg1JR55141
http://www-01.ibm.com/support/docview.wss?uid=swg1JR55264
http://www-01.ibm.com/support/docview.wss?uid=swg21983625

Get alerted when CVE-2016-2862 or the next vulnerability affects your stack