{"id":"CVE-2016-20102","title":"JavaMelody < 1.60.0 Reflected XSS via monitoring graph parameter","summary":"JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the graph parameter of /monitoring?part=graph. Attackers can include a…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"JavaMelody","product":"JavaMelody","affected":["JavaMelody >= 1.8.2 < 1.60.0"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T20:31:28.188Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2016-20102","references":[{"url":"https://github.com/javamelody/javamelody/pull/555","label":"Pull Request"},{"url":"https://github.com/javamelody/javamelody/commit/de7b648eebc3254fcb82fcda60de83a212271def","label":"Patch Commit"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/java-melody-xss.yaml","label":"Nuclei Template"},{"url":"https://www.vulncheck.com/advisories/javamelody-1.60.0-reflected-xss-via-monitoring-graph-parameter","label":"VulnCheck Advisory: JavaMelody < 1.60.0 Reflected XSS via monitoring graph parameter"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T21:19:21.263Z","slug":"CVE-2016-20102","body":"## Overview\n\nJavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the graph parameter of /monitoring?part=graph. Attackers can include a closing script tag in the graph value, which is only JavaScript-escaped in HtmlCounterReport, to execute script in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.\n\n## Affected\n\n- `JavaMelody >= 1.8.2 < 1.60.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}