{"action":"Upgrade plone to 4.3.12 or later.","affected":[{"fixed":"4.3.12","introduced":"0"},{"fixed":"5.0.7","introduced":"5.0"}],"component":"plone","cve_ids":["CVE-2016-7147"],"ecosystem":"PyPI","epss":0.01334,"exploited":false,"fixed_versions":["4.3.12","5.0.7"],"ghsa_id":"GHSA-84jm-cpc5-c7g7","id":"tcs_01M5KG7E3K7Z34VF5W7YZQ8ES7","modified_at":"2026-06-10T17:01:33.801274948Z","published_at":"2017-02-04T05:59:00Z","references":["https://osv.dev/vulnerability/PYSEC-2017-64","https://www.curesec.com/blog/article/blog/Plone-XSS-186.html","https://plone.org/security/hotfix/20170117/non-persistent-xss-in-zope2","https://plone.org/security/hotfix/20170117","http://www.securityfocus.com/bid/96117","https://github.com/advisories/GHSA-84jm-cpc5-c7g7"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"PYSEC-2017-64","url":"https://osv.dev/vulnerability/PYSEC-2017-64"},{"source":"nvd","source_id":"CVE-2016-7147","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7147"}],"summary":"Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary we"}