CVE-2016-10006

MEDIUM

OWASP AntiSamy <1.5.5 - XSS

Title source: llm
STIX 2.1

Description

In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. The impact is XSS.

Exploits (2)

nomisec WORKING POC
by shoucheng3 · poc
https://github.com/shoucheng3/nahsra__antisamy_CVE-2016-10006_1-5-3
nomisec WRITEUP
by epicosy · poc
https://github.com/epicosy/VUL4J-60

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1037532
Patch, Vendor Advisory x_refsource_confirm
https://github.com/nahsra/antisamy/issues/2
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/95101

Scores

CVSS v3 6.1
EPSS 0.0054
EPSS Percentile 67.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
antisamy_project/antisamy < 1.5.5
org.owasp.antisamy/antisamy 0 - 1.5.5Maven
Published Dec 24, 2016
Tracked Since Feb 18, 2026