Apache OpenMeetings Cross-site Scripting vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2016-3089 · ADVISORY
• apache/openmeetings · PACKAGE
• apache.org/dist/openmeetings/3.1.2/CHANGELOG · WEB
• openmeetings.apache.org/security.html · WEB
• packetstormsecurity.com/files/138313/Apache-OpenMeetings-3.1.0-Cross-Site-Scripting.html · WEB
• securityfocus.com/archive/1/539192/100/0/threaded · WEB
• securityfocus.com/bid/92442 · WEB

More vulnerabilities in org.apache.openmeetings:openmeetings-parent

• CVE-2026-34020HIGH 7.5Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method w…
• CVE-2026-33266HIGH 7.5Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings. The remember-me cookie encryption key is set to default value in …
• CVE-2026-33005MEDIUM 4.3Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. Any registered user can query web service with their cre…
• CVE-2024-54676CRITICAL 9.8Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering inst…
• CVE-2023-29246HIGH 7.2An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versi…