Servers and applications
CVE-2016-4790
Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Severity
- Medium 5.5
- Published
- 26 May 2016
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 1% in the next 30 daysHigher than 63% of CVEs. EPSS by FIRST, 11 Nov 2026
- Weakness
- Cross-site scripting (CWE-79)
- Attack
- Over the network · Needs an administrator account · No user action needed
- Attacker can
- Read some data · Change some data
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Ivanti Connect SecureServers and applications · cpe:a:ivanti:connect_secure |
|