Servers and applications
CVE-2015-7536
Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts.
- Severity
- Medium 5.4
- Published
- 3 Feb 2016
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 1.3% in the next 30 daysHigher than 69% of CVEs. EPSS by FIRST, 11 Nov 2026
- Weakness
- Cross-site scripting (CWE-79)
- Attack
- Over the network · Needs a user account · Needs someone to click or open something
- Attacker can
- Read some data · Change some data
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
JenkinsServers and applications · cpe:a:jenkins:jenkins |
|