---
id: CVE-2016-20102
title: JavaMelody < 1.60.0 Reflected XSS via monitoring graph parameter
summary: >-
  JavaMelody before 1.60.0 contains a reflected cross-site scripting
  vulnerability that allows unauthenticated attackers to inject script by
  supplying crafted values in the graph parameter of /monitoring?part=graph.
  Attackers can include a…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: JavaMelody
product: JavaMelody
affected:
  - JavaMelody >= 1.8.2 < 1.60.0
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T20:31:28.188Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2016-20102'
references:
  - url: 'https://github.com/javamelody/javamelody/pull/555'
    label: Pull Request
  - url: >-
      https://github.com/javamelody/javamelody/commit/de7b648eebc3254fcb82fcda60de83a212271def
    label: Patch Commit
  - url: >-
      https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/java-melody-xss.yaml
    label: Nuclei Template
  - url: >-
      https://www.vulncheck.com/advisories/javamelody-1.60.0-reflected-xss-via-monitoring-graph-parameter
    label: >-
      VulnCheck Advisory: JavaMelody < 1.60.0 Reflected XSS via monitoring graph
      parameter
tags:
  - cve.org
ingestedAt: '2026-10-20T21:19:21.263Z'
---

## Overview

JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the graph parameter of /monitoring?part=graph. Attackers can include a closing script tag in the graph value, which is only JavaScript-escaped in HtmlCounterReport, to execute script in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

## Affected

- `JavaMelody >= 1.8.2 < 1.60.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.