Live › vulnerability › CVE-2016-20102
Go to dashboardJavaMelody, a Java application monitoring library, fails to escape a closing script tag in the graph parameter of /monitoring?part=graph. An attacker who gets a victim to open a crafted link runs script in the victim's browser, and no login is needed to send the request.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that bundle JavaMelody before and serve its /monitoring page are exposed, since the flaw is in the graph parameter that page reads. Teams that do not use JavaMelody, or run a version at or above , can skip it. Whether the page is reachable from outside the network is unknown from the sources.
1.60.01.60.0No product ranges from the sources yet.
javamelody-core in pom.xml or the Gradle file, and look for any version below 1.60.0/monitoring in the deployed application, which is where the reflected parameter is handled1.60.0 or later/monitoring path to trusted networks or staffEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the graph parameter of /monitoring?part=graph. Attackers can include a closing script tag in the graph value, which is only JavaScript-escaped in HtmlCounterReport, to execute script in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
This page as .md · .json · in your agent: get_signal("CVE-2016-20102")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.