CVE-2016-1000273
Java Melody vulnerable to cross-site scripting
JavaMelody is a monitoring tool for JavaEE applications. Versions prior to 1.61.0 are vulnerable to a cross-site scripting (XSS) attack. This issue was patched in version 1.61.0, and users are recommended to upgrade to the latest version. There are no known workarounds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
GitHub Advisories Score usedGHSA-cqhr-jqvc-qw9p
Java Melody vulnerable to cross-site scripting
JavaMelody is a monitoring tool for JavaEE applications. Versions prior to 1.61.0 are vulnerable to a cross-site scripting (XSS) attack. This issue was patched in version 1.61.0, and users are recommended to upgrade to the latest version. There are no known workarounds.
- Record
GHSA-cqhr-jqvc-qw9p- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-cqhr-jqvc-qw9p
Java Melody vulnerable to cross-site scripting
JavaMelody is a monitoring tool for JavaEE applications. Versions prior to 1.61.0 are vulnerable to a cross-site scripting (XSS) attack. This issue was patched in version 1.61.0, and users are recommended to upgrade to the latest version. There are no known workarounds.
- Record
GHSA-cqhr-jqvc-qw9p- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
net.bull.javamelody:javamelody-coreMaven |
before 1.61.0 | 1.61.0 |
net.bull.javamelody:javamelody-coreMaven |
before 1.61.0, plus listed versions 1.10.01.11.01.11.11.12.01.13.0 Show 45 moreShow less1.14.01.15.01.16.01.16.11.17.01.18.01.19.01.20.01.21.01.22.01.23.01.25.01.26.01.27.01.28.01.29.01.29.11.30.01.31.01.32.01.32.11.33.01.34.01.35.01.36.01.37.01.38.01.39.01.40.01.41.01.42.01.43.01.44.01.45.01.46.01.47.01.48.01.49.01.50.01.51.01.52.01.53.01.54.01.55.01.56.0 |
1.61.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-1000273 is a critical vulnerability (CVSS 10.0) in net.bull.javamelody:javamelody-core, published July 20, 2022. No source lists public exploit code. Fixed in net.bull.javamelody:javamelody-core 1.61.0.
References
Left out here: 8 versions. The JSON record has them.