JavaMelody CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM JavaMelody CVE published 2026-10-20

CVE-2016-20102

JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the graph parameter of /monitoring?part=graph. The vulnerability is caused by inadequate JavaScript escaping in HtmlCounterReport. This issue can lead to script execution in victims' browsers. Defenders should assess exposure and prioritize [truncated]