CVE-2016-6191
MEDIUMSOGo <3.1.3 - XSS
Title source: llmDescription
Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) Description, (2) Location, (3) URL, or (4) Title field.
Scores
CVSS v3
6.1
EPSS
0.0033
EPSS Percentile
55.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Classification
CWE
CWE-79
Status
published
Affected Products (2)
alinto/sogo
< 3.1.2
n/a/n/a
Timeline
Published
Feb 17, 2017
Tracked Since
Feb 18, 2026