PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7149 B2evolution CVE debrief

CVE-2016-7149 is a cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier. The issue is tied to the autolink function, allowing remote attackers to inject script or HTML content. Because the vulnerability is network-reachable and requires user interaction, it is best treated as a web-facing content-safety issue that can affect administrators and site visitors.

Vendor
B2evolution
Product
Unknown
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-18
Original CVE updated
2026-05-13
Advisory published
2017-01-18
Advisory updated
2026-05-13

Who should care

Teams running b2evolution sites at version 6.7.5 or earlier, especially CMS/blog administrators, hosting providers, and security teams responsible for web content integrity and session protection.

Technical summary

NVD classifies the issue as CWE-79 with CVSS v3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerable scope in the NVD CPE entry covers b2evolution versions through 6.7.5. The supplied references include mailing list advisories and a GitHub patch commit, indicating the issue was addressed upstream.

Defensive priority

Medium. The severity score is moderate, but XSS in a content management platform can expose sessions, alter page content, and undermine trust in rendered output. Prioritize if the product is internet-facing or used by privileged editors.

Recommended defensive actions

  • Upgrade b2evolution to a version newer than 6.7.5 or apply the vendor fix referenced by the upstream patch commit.
  • Review any user-supplied content paths that feed the autolink function and verify output encoding/sanitization is enforced before rendering.
  • Check templates, theme overrides, and plugins for custom rendering logic that may reintroduce unsafe HTML output.
  • Audit administrator and editor accounts for suspicious activity if the vulnerable version was exposed publicly.
  • Use browser-side protections such as a restrictive Content Security Policy where feasible to reduce XSS impact.

Evidence notes

This debrief is based on the supplied NVD record, which identifies the vulnerability as CVE-2016-7149 in b2evolution through 6.7.5, with CWE-79 and CVSS vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Supporting references include Openwall mailing list posts from 2016-09-12 and 2016-09-15, SecurityFocus BID 92967, and the upstream GitHub patch commit 9a4ab85439d1b838ee7b8eeebbf59174bb787811.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-7149 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-7149

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-7149 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-7149

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.