Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2995 advisory.

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability     in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.
    (CVE-2025-1647)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability     in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.
    (CVE-2025-1647)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its self-reported version number, Bootstrap is prior to 4.0.0. Therefore, it may be affected by Multiples Cross-Site Scripting (XSS) vulnerability :

- A Cross-Site Scripting (XSS) vulnerability has been identified within the Bootstrap 3 Button component.

- A Cross-Site Scripting (XSS) vulnerability has been identified within the Bootstrap 3 Popover component and Bootstrap 3 Tooltip component, which allows unsanitized HTML to be used.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4204 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4204-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     June 01, 2025                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : twitter-bootstrap3     Version        : 3.4.1+dfsg-2+deb11u2     CVE ID         : CVE-2025-1647     Debian Bug     : 1105899

    twitter-bootstrap3 a popular front end framework was affected     by a vulnerability.

    A cross-site scripting (XSS) vulnerability     has been identified within the Bootstrap 3 Popover component and     Bootstrap 3 Tooltip component, which allows unsanitized HTML to be used.

    If you use bootstrap through a module bundler, you may need to rebuild your     application.

    For Debian 11 bullseye, this problem has been fixed in version     3.4.1+dfsg-2+deb11u2.

    We recommend that you upgrade your twitter-bootstrap3 packages.

    For the detailed security status of twitter-bootstrap3 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/twitter-bootstrap3

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
265082	Amazon Linux 2 : pki-core, --advisory ALAS2-2025-2995 (ALAS-2025-2995)	Nessus	Amazon Linux Local Security Checks	medium
245488	Linux Distros Unpatched Vulnerability : CVE-2025-1647	Nessus	Misc.	medium
114900	Bootstrap < 4.0.0 Multiples Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
237630	Debian dla-4204 : fonts-glyphicons-halflings - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2025-1647

medium

Tenable Plugins

medium

medium

medium

medium