According to its self-reported version number, Bootstrap is prior to 4.0.0. Therefore, it may be affected by Multiples Cross-Site Scripting (XSS) vulnerability :

- A Cross-Site Scripting (XSS) vulnerability has been identified within the Bootstrap 3 Button component.

- A Cross-Site Scripting (XSS) vulnerability has been identified within the Bootstrap 3 Popover component and Bootstrap 3 Tooltip component, which allows unsanitized HTML to be used.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability
    in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.
    (CVE-2025-1647)

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4204 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4204-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     June 01, 2025                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : twitter-bootstrap3     Version        : 3.4.1+dfsg-2+deb11u2     CVE ID         : CVE-2025-1647     Debian Bug     : 1105899

    twitter-bootstrap3 a popular front end framework was affected     by a vulnerability.

    A cross-site scripting (XSS) vulnerability     has been identified within the Bootstrap 3 Popover component and     Bootstrap 3 Tooltip component, which allows unsanitized HTML to be used.

    If you use bootstrap through a module bundler, you may need to rebuild your     application.

    For Debian 11 bullseye, this problem has been fixed in version     3.4.1+dfsg-2+deb11u2.

    We recommend that you upgrade your twitter-bootstrap3 packages.

    For the detailed security status of twitter-bootstrap3 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/twitter-bootstrap3

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2995 advisory.

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability     in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.
    (CVE-2025-1647)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4830 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4830-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     October 08, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : twitter-bootstrap3     Version        : 3.4.1+dfsg-3+deb12u2     CVE ID         : CVE-2025-1647     Debian Bug     : 1105899

    twitter-bootstrap3 a popular front end framework was affected     by a vulnerability.

    A cross-site scripting (XSS) vulnerability     has been identified within the Bootstrap 3 Popover component and     Bootstrap 3 Tooltip component, which allows unsanitized HTML to be used.

    If you use bootstrap through a module bundler, you may need to rebuild your     application.

    For Debian 12 bookworm, this problem has been fixed in version     3.4.1+dfsg-3+deb12u2.

    We recommend that you upgrade your twitter-bootstrap3 packages.

    For the detailed security status of twitter-bootstrap3 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/twitter-bootstrap3

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability     in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.
    (CVE-2025-1647)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
114900	Bootstrap < 4.0.0 Multiples Cross-Site Scripting	Web App Scanning	Component Vulnerability	7/3/2025	7/24/2025	medium
446735	SCA: security update for bootstrap (GHSA-q58r-hwc8-rm9j)	Tenable Cloud Security	SCA Checks	8/31/2026	10/9/2026	medium
474218	Chainguard: rancher-api-ui: security update to 1.2.3-r3	Tenable Cloud Security	Chainguard Local Security Checks	10/10/2026	10/13/2026	medium
446735	SCA: security update for bootstrap (GHSA-q58r-hwc8-rm9j)	Tenable Self-Hosted Container Security	SCA Checks	8/31/2026	10/9/2026	medium
474218	Chainguard: rancher-api-ui: security update to 1.2.3-r3	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	10/10/2026	10/13/2026	medium
237630	Debian dla-4204 : fonts-glyphicons-halflings - security update	Nessus	Debian Local Security Checks	6/1/2025	6/1/2025	medium
265082	Amazon Linux 2 : pki-core, --advisory ALAS2-2025-2995 (ALAS-2025-2995)	Nessus	Amazon Linux Local Security Checks	9/16/2025	9/16/2025	medium
364362	Debian dla-4830 : fonts-glyphicons-halflings - security update	Nessus	Debian Local Security Checks	10/9/2026	10/9/2026	medium
245488	Linux Distros Unpatched Vulnerability : CVE-2025-1647	Nessus	Misc.	8/7/2025	8/30/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium