getbootstrap bootstrap vulnerabilities

Latest getbootstrap bootstrap CVEs

Newest publication first

1. CVE-2024-6485 XSS in Bootstrap button component

   Published 2024-07-11

   Medium·CVSS 6.4

   A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript cod...

2. CVE-2019-8331 Bootstrap Vulnerable to Cross-Site Scripting

   Published 2019-02-20

   Medium·CVSS 6.1 EPSS 16.4% Public exploit PoC

   In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

3. CVE-2018-20677 bootstrap Cross-site Scripting vulnerability

   Published 2019-01-09

   Medium·CVSS 6.1 EPSS 4.0% PoC

   In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

4. CVE-2018-20676 XSS vulnerability that affects bootstrap

   Published 2019-01-09

   Medium·CVSS 6.1 EPSS 3.8% PoC

   In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

5. CVE-2016-10735 Bootstrap Cross-site Scripting vulnerability

   Published 2019-01-09

   Medium·CVSS 6.1 EPSS 4.0% PoC

   In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

6. CVE-2018-14041 Bootstrap Cross-site Scripting vulnerability

   Published 2018-07-13

   Medium·CVSS 6.1 EPSS 4.3% Public exploit PoC

   In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.

7. CVE-2018-14042 Bootstrap Cross-site Scripting vulnerability

   Published 2018-07-13

   Medium·CVSS 6.1 EPSS 4.0% Public exploit PoC

   In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

8. CVE-2018-14040 Bootstrap vulnerable to Cross-Site Scripting (XSS)

   Published 2018-07-13

   Medium·CVSS 6.1 EPSS 4.1% Public exploit PoC

   In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.