VulnerabilityModified

CVE-2017-16356

Reflected XSS in Kubik-Rubik SIGE (aka Simple Image Gallery Extended) before 3.3.0 allows attackers to execute JavaScript in a victim's browser by having them visit a plugins/content/sige/plugin_sige/print.php link with a crafted img, name, or caption…

EXPLOITMEDIUM 6.1EPSS 2.19%

Does this matter?

A public exploit is published in Exploit-DB, so the technical barrier is gone even though the severity is medium and EPSS is 2.2%. Treat it as high on anything reachable from the internet.

Description

CVSS 3.0: 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 2.19% probability · 82th percentile
Public exploits: 1 in Exploit-DB · first 16 February 2018
CISA KEV: Not listed
Weakness: CWE-79
Affected: kubik-rubik/simple image gallery extended
Source: cve@mitre.org

EPSS trend

EPSS 2.2% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

Public exploits (1)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-ID	Title	Type	Published	Verified
EDB-44104 source ↗	Joomla! Component Kubik-Rubik Simple Image Gallery Extended (SIGE) 3.2.3 - Cross-Site Scriptingphp · Alwin Peppels	webapps	16 February 2018	no

References

http://packetstormsecurity.com/files/146422/Joomla-Kubik-Rubik-SIGE-3.2.3-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/44104/Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/146422/Joomla-Kubik-Rubik-SIGE-3.2.3-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/44104/Exploit, Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.