LiveActive security incident?Get immediate response
CVE Record

CVE-2016-10744: In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS.

In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This CVE describes cross-site scripting in Select2 through 4.0.5 when rich dropdowns render remote Ajax data with HTML templates. If an application displays untrusted option text as HTML, a user viewing the dropdown could be exposed to script execution in that application context.

Executive priority

Prioritize verification for internet-facing or multi-user applications where dropdown data can be user-controlled. Treat confirmed exposure as a normal XSS remediation item, not an emergency, unless sensitive workflows or privileged users are affected.

Technical view

The vulnerable condition is specific: Select2 rich selectlists using Ajax remote data loading plus HTML templating for listbox data. The record names Snipe-IT as an example consumer, but the affected inventory depends on embedded Select2 version and how templates handle remote data.

Likely exposure

Applications are likely exposed only where Select2 through 4.0.5 is present and configured to render Ajax-sourced dropdown content through HTML templates. Generic Select2 use without remote untrusted HTML rendering may not match the described condition.

Exploitation context

The provided bundle does not show CISA KEV listing, public exploitation, or CVSS scoring. The issue is still security-relevant because XSS can affect authenticated sessions, but business urgency depends on whether untrusted data reaches rich selectlist templates.

Researcher notes

Evidence is narrow but useful: the CVE describes Select2 through 4.0.5 and a specific Ajax-plus-template condition. The bundle lacks CVSS, CWE, detailed affected CPEs, and confirmed fixed versions, so validation should focus on application behavior, not package presence alone.

Mitigation direction

  • Inventory applications bundling Select2 through 4.0.5.
  • Check vendor guidance for Select2 and dependent products such as Snipe-IT.
  • Avoid rendering untrusted Ajax fields as HTML in select templates.
  • Escape or sanitize listbox data before display.
  • Review the referenced Snipe-IT pull request and commit for remediation context.

Validation and detection

  • Identify Select2 versions in frontend dependencies and packaged vendor assets.
  • Search code for Select2 Ajax usage with HTML template rendering.
  • Trace whether remote option data can be influenced by users or external systems.
  • Confirm dropdown output treats untrusted values as text or sanitized HTML.
  • Review Snipe-IT deployments for the referenced vulnerable pattern.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2016-10744 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.