CVE-2016-9757: In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has...

Security readout for executives and security teams

Rapid7 Nexpose 6.4.12 allowed an authenticated user with tag-creation rights to place script content in a tag name. When another logged-in user viewed that tag’s detail page, the script could run in their browser session. This is most concerning where many users can create tags or where administrators routinely review user-created tags. Exposure appears limited to Rapid7 Nexpose version 6.4.12 installations where authenticated users have permission to create tags. Internet exposure is not required by the CVE description, but risk increases if the Nexpose console is broadly accessible or permissions are loosely assigned. Treat this as a targeted remediation item, not an emergency based on the supplied evidence. Prioritize if Nexpose 6.4.12 is still used, tag creation is widely delegated, or high-privilege users regularly review tags. Mitigation focus: Check Rapid7 guidance and release notes for the recommended Nexpose update path.; Move affected Nexpose 6.4.12 systems off the vulnerable version where feasible.; Restrict tag-creation capability to trusted administrators until remediated..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.