Back to CVE Browser

CVE-2016-6856

MEDIUM

6.1

CVSS Severity Score

EPSS Score0.0560%

EPSS Percentile13.39th

PublishedDec 31, 2016

Last ModifiedMay 6, 2026

Vulnerability Description

Cross-site scripting (XSS) vulnerability in the Inbox Search feature in Hybris Management Console (HMC) in SAP Hybris before 6.0 allows remote attackers to inject arbitrary web script or HTML via the itemsperpage parameter.

Affected Platforms (CPE)

📦

Sap

Hybris

<= 5.6.0.10

References & Advisories

🔗 http://www.securityfocus.com/bid/93954

🔗 https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CVE-2016-685X_SAP-Hybris_XSS.txt

🔗 http://www.securityfocus.com/bid/93954

🔗 https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CVE-2016-685X_SAP-Hybris_XSS.txt

Related Vulnerabilities

CVE-2019-03449.8

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, i...

CVE-2018-24638.6

The Omni Commerce Connect API (OCC) of SAP Hybris Commerce, versions 6.*, is vulnerable to server-side request forgery (SSRF) atta...

CVE-2014-88717.5

Directory traversal vulnerability in hybris Commerce software suite 5.0.3.3 and earlier, 5.0.0.3 and earlier, 5.0.4.4 and earlier,...

CVE-2019-03227.5

SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an at...