CVE-2016-7251: Microsoft SQL Server

Medium severity, CVSS 6.1. EPSS: 8.2% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in the MDS API in Microsoft SQL Server 2016 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "MDS API XSS Vulnerability."

Affected products

• Microsoft SQL Server: version 2016 only

Published 2016-11-10. Last modified 2026-06-17.