CVE-2016-3971

MEDIUM · CVSS 4.8 EPSS 0.66%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2016-04-18 · Last synced 2026-08-04

Field Assessment

AI analysis pending.

CVE

CVE-2016-3971

Severity

MEDIUM

CVSS

4.8

EPSS

0.66%

Original Filing — NVD Description

Cross-site scripting (XSS) vulnerability in lucene_search.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter to c/portal/layout.