CVE-2016-4849
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2016-4849
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-4849.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2016-4849
- Published
- 2017-04-20T17:59:00Z
- Modified
- 2025-07-01T03:10:01.859553Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Multiple cross-site scripting (XSS) vulnerabilities in Geeklog IVYWE edition 2.1.1 allow remote attackers to inject arbitrary web script or HTML by leveraging use of the COMgetCurrentURL function in (1) publichtml/layout/default/header.thtml, (2) publichtml/layout/bento/header.thtml, (3) publichtml/layout/fotos/header.thtml, or (4) public_html/layout/default/article/article.thtml.
- References
-
- http://jvn.jp/en/jp/JVN09836883/index.html
- http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000150.html
- http://www.securityfocus.com/bid/92545
- https://www.ivywe.co.jp/article.php/xss-ivywe-distribution
- https://github.com/ivywe/geeklog-ivywe/commit/41f4677e2eaa587b80eb9801150c1b402344c43d
- https://github.com/ivywe/geeklog-ivywe/commit/beba390fd86bd991414ebf73e3482966d7115654