CVE-2016-4428Medium· 5.4▾ SunlitOpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
2.1%
2.1% → 2.1%
Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.
horizon < 8.0.2horizon >= 9.0.0, < 9.1.0Upgrade to a patched release:
horizon 8.0.2horizon 9.1.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-43002Medium· 5.3An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3
CVE-2014-3474LowOpenStack Horizon Cross-site scripting (XSS) vulnerability
CVE-2014-0157MediumOpenStack Dashboard (aka Horizon) vulnerable to Cross-site Scripting
CVE-2014-3473MediumHorizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name
CVE-2014-3594LowOpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface
CVE-2017-7400Medium· 4.8OpenStack Horizon Cross-site Scripting (XSS)