{"id":"CVE-2016-4561","aliases":["DEBIAN-CVE-2016-4561","DLA-463-1","DSA-3571-1","EUVD-2016-5548","GHSA-vxg6-rr45-x5cv","MGASA-2019-0113","UBUNTU-CVE-2016-4561","openSUSE-SU-2024:10860-1"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in the cgierror function in CGI.pm in ikiwiki before 3...","description":"Cross-site scripting (XSS) vulnerability in the cgierror function in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving an error message.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01465,"percentile":0.73827,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2016-05-08T00:00:00Z","modified":"2026-09-22T07:02:06Z","fixes":[{"ecosystem":"Debian:12","package":"ikiwiki","fixed_in":["3.20160506"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ikiwiki","fixed_in":["3.20160506"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ikiwiki","fixed_in":["3.20160506"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"ikiwiki","fixed_in":["3.20120629.2+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"ikiwiki","fixed_in":["3.20141016.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ikiwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20160506"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ikiwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20160506"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ikiwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20160506"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"ikiwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20120629.2+deb7u1"}]}],"versions":["3.20120629","3.20120629.1","3.20120629.2"]},{"source":"osv","ecosystem":"Debian:8","package":"ikiwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20141016.3"}]}],"versions":["3.20141016.2"]},{"source":"osv","ecosystem":"Mageia:6","package":"ikiwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20190228-1.1.mga6"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ikiwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.20150614","3.20160121"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ikiwiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20200202.3-2.7"}]}],"bundled":14}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"ikiwiki","product":"ikiwiki"}],"references":[{"url":"http://source.ikiwiki.branchable.com/?p=source.git%3Ba=commitdiff%3Bh=32ef584dc5abb6ddb9f794f94ea0b2934967bba7","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3571","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://ikiwiki.info/security/#index43h2","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4561"},{"url":"http://source.ikiwiki.branchable.com/?p=source.git;a=commitdiff;h=32ef584dc5abb6ddb9f794f94ea0b2934967bba7","tags":["report"]},{"url":"https://github.com/advisories/GHSA-vxg6-rr45-x5cv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-4561","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0113.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24453","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2019/02/28/1","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2017/01/12/2","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2016/05/06/8","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2016/05/06/9","tags":["web"]},{"url":"https://www.debian.org/security/2019/dsa-4399","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-4561","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/05/06/8","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4561","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-0356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9187","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-4561","description":"Cross-site scripting (XSS) vulnerability in the cgierror function in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving an error message.","status":"published","published":"2016-05-10T19:00:00Z","modified":"2024-08-06T00:32:25.84Z","updated_at":"2026-11-02T14:33:35.149563Z"}],"euvd":[{"id":"EUVD-2016-5548","description":"Cross-site scripting (XSS) vulnerability in the cgierror function in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving an error message.","status":"published","published":"2016-05-10T19:00:00Z","modified":"2024-08-06T00:32:25Z","updated_at":"2026-11-03T02:22:45.901874Z"}],"ghsa":[{"id":"GHSA-vxg6-rr45-x5cv","title":"Cross-site scripting (XSS) vulnerability in the cgierror function in CGI.pm in ikiwiki before 3...","description":"Cross-site scripting (XSS) vulnerability in the cgierror function in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving an error message.","status":"published","published":"2022-05-17T03:55:39Z","modified":"2025-04-12T12:59:37Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:01:26.909163Z"}],"nvd":[{"id":"CVE-2016-4561","description":"Cross-site scripting (XSS) vulnerability in the cgierror function in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving an error message.","status":"published","published":"2016-05-10T19:59:04.307Z","modified":"2026-06-17T00:47:47.187Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:25.366449Z"}],"osv":[{"id":"CVE-2016-4561","description":"Cross-site scripting (XSS) vulnerability in the cgierror function in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving an error message.","status":"published","published":"2016-05-10T19:59:04.307Z","modified":"2026-04-16T06:15:28.510649341Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-4561","description":"Cross-site scripting (XSS) vulnerability in the cgierror function in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving an error message.","status":"published","published":"2016-05-10T19:59:04.307Z","modified":"2026-09-22T07:02:06.285159445Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-4561","description":"Cross-site scripting (XSS) vulnerability in the cgierror function in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving an error message.","status":"published","published":"2016-05-10T19:59:00Z","modified":"2025-10-24T04:45:46Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"DLA-463-1","title":"ikiwiki - security update","status":"published","published":"2016-05-10T00:00:00Z","modified":"2026-03-09T02:10:33.595661Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3571-1","title":"ikiwiki - security update","status":"published","published":"2016-05-08T00:00:00Z","modified":"2026-03-09T01:22:27.545838Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2019-0113","title":"Updated ikiwiki packages fix security vulnerability","description":"Several security issues identified in ikiwiki fixed by updating to\nversion 3.20190228. See references for details\n","status":"published","published":"2019-03-15T16:56:09Z","modified":"2026-04-16T06:22:50.315214515Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:10860-1","title":"ikiwiki-3.20200202.3-2.7 on GA media","description":"These are all security issues fixed in the ikiwiki-3.20200202.3-2.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:32:41.040879Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}