{"id":"CVE-2016-3056","aliases":["EUVD-2016-4129","GHSA-w3vp-cj4w-cr75"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in Business Space in IBM Business Process Manager 7.5...","description":"Cross-site scripting (XSS) vulnerability in Business Space in IBM Business Process Manager 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, and 8.5 before 8.5.7.0 CF2016.09 allows remote authenticated users to inject arbitrary web script or HTML via crafted content.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00978,"percentile":0.6241,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2016-10-14T01:00:00Z","modified":"2026-06-17T00:44:53Z","products":[{"vendor":"ibm","product":"business_process_manager"}],"references":[{"url":"http://www.securityfocus.com/bid/93405","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1JR56300","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21990850","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3056"},{"url":"https://github.com/advisories/GHSA-w3vp-cj4w-cr75"}],"sources":{"cve":[{"id":"CVE-2016-3056","description":"Cross-site scripting (XSS) vulnerability in Business Space in IBM Business Process Manager 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, and 8.5 before 8.5.7.0 CF2016.09 allows remote authenticated users to inject arbitrary web script or HTML via crafted content.","status":"published","published":"2016-10-14T01:00:00Z","modified":"2024-08-05T23:40:15.142Z","updated_at":"2026-11-02T14:33:34.094161Z"}],"euvd":[{"id":"EUVD-2016-4129","description":"Cross-site scripting (XSS) vulnerability in Business Space in IBM Business Process Manager 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, and 8.5 before 8.5.7.0 CF2016.09 allows remote authenticated users to inject arbitrary web script or HTML via crafted content.","status":"published","published":"2016-10-14T01:00:00Z","modified":"2024-08-05T23:40:15Z","updated_at":"2026-11-03T02:22:51.669902Z"}],"ghsa":[{"id":"GHSA-w3vp-cj4w-cr75","title":"Cross-site scripting (XSS) vulnerability in Business Space in IBM Business Process Manager 7.5...","description":"Cross-site scripting (XSS) vulnerability in Business Space in IBM Business Process Manager 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, and 8.5 before 8.5.7.0 CF2016.09 allows remote authenticated users to inject arbitrary web script or HTML via crafted content.","status":"published","published":"2022-05-17T03:42:18Z","modified":"2023-01-27T05:08:59Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:43:21.16147Z"}],"nvd":[{"id":"CVE-2016-3056","description":"Cross-site scripting (XSS) vulnerability in Business Space in IBM Business Process Manager 7.5 through 7.5.1.2, 8.0 through 8.0.1.3, and 8.5 before 8.5.7.0 CF2016.09 allows remote authenticated users to inject arbitrary web script or HTML via crafted content.","status":"published","published":"2016-10-14T02:59:06.047Z","modified":"2026-06-17T00:44:53.303Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:31.485755Z"}]}}