{"id":"CVE-2016-1229","details":"Cross-site scripting (XSS) vulnerability in HumHub 0.20.0-beta.1 through 0.20.1 and 1.0.0-beta before 1.0.0-beta.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.","modified":"2026-08-07T11:47:21.038744903Z","published":"2016-06-05T01:59:03.297Z","database_specific":{"unresolved_ranges":[{"source":"CPE_STRING","vendor_product":"humhub:humhub","cpes":["cpe:2.3:a:humhub:humhub:0.20.0:beta1:*:*:*:*:*:*","cpe:2.3:a:humhub:humhub:0.20.0:beta2:*:*:*:*:*:*","cpe:2.3:a:humhub:humhub:1.0.0:beta1:*:*:*:*:*:*","cpe:2.3:a:humhub:humhub:1.0.0:beta2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0.20.0-beta1"},{"last_affected":"0.20.0-beta1"},{"introduced":"0.20.0-beta2"},{"last_affected":"0.20.0-beta2"},{"introduced":"1.0.0-beta1"},{"last_affected":"1.0.0-beta1"},{"introduced":"1.0.0-beta2"},{"last_affected":"1.0.0-beta2"}]}]},"references":[{"type":"ADVISORY","url":"http://jvn.jp/en/jp/JVN56167268/index.html"},{"type":"ADVISORY","url":"http://jvndb.jvn.jp/jvndb/JVNDB-2016-000068"},{"type":"FIX","url":"https://github.com/humhub/humhub/releases/tag/v1.0.0-beta.3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/humhub/humhub","events":[{"introduced":"306549ddfb566651bc98030d503a2a2e78c8848a"},{"last_affected":"6ab6c0a923800ead877d5f222a51f5f4236d889a"},{"fixed":"fbcfcbbb4469542d6730fd069c8d2e42ac2bed2e"}],"database_specific":{"source":["CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:humhub:humhub:0.20.0:*:*:*:*:*:*:*","cpe:2.3:a:humhub:humhub:0.20.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0.20.0"},{"last_affected":"0.20.0"},{"introduced":"0.20.1"},{"last_affected":"0.20.1"}]}}],"versions":["0.20.0","0.20.1","v1.0.0-beta.2","v1.0.0-beta.1","v0.20.1","v0.20.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-1229.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}