Medium severity · published Jan 26, 2016
CVE-2016-1298
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Contact Center Express 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allow remote attackers to inject arbitrary web…
6.1
CVSS
1.1%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Contact Center Express 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allow remote attackers to inject arbitrary web script or HTML via vectors related to permalinks, aka Bug ID CSCux92033.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UC
Unified Contact Center Express · Cisco
10.0(1); 10.5(1); 10.6(1); 11.0(1) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-1298
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-1298
Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160125-ucce
Third Party Advisory
http://www.securitytracker.com/id/1034828
More from Unified Contact Center Express
10.0
CVE-2024-20253
A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an…
9.8
CVE-2025-20358
Cisco Unified Contact Center Express Editor Authentication Bypass Vulnerability
9.8
CVE-2025-20354
Cisco Unified Contact Center Express Remote Code Execution Vulnerability
9.8
CVE-2020-3280
A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to execute arbitrary…
9.8
CVE-2018-0403
Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to retrieve a…