CVE-2016-10744: SELECT2

Medium severity, CVSS 6.1. EPSS: 1.8% chance of exploitation in the next 30 days.

In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.

Affected products

• SELECT2 SELECT2: up to and including 4.0.5

Published 2019-03-27. Last modified 2026-06-17.