CVE-2016-20036

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-20036
Wowza Streaming Engine 4.5.0 contains multiple reflected cross-site scripting vulnerabilities in the enginemanager interface where input passed through various parameters is not properly sanitized before being returned to users. Attackers can inject malicious script code through parameters like appName, vhost, uiAppType, and wowzaCloudDestinationType in multiple endpoints to execute arbitrary HTML and JavaScript in a user's browser session.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5343.php Exploit Third Party Advisory
https://www.exploit-db.com/exploits/40135 Exploit Third Party Advisory VDB Entry
https://www.vulncheck.com/advisories/wowza-streaming-engine-multiple-cross-site-scripting-vulnerabilities Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wowza:streaming_engine:4.5.0:*:*:*:*:*:*:*
History

19 Mar 2026, 14:17

Type Values Removed Values Added
References () http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5343.php - () http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5343.php - Exploit, Third Party Advisory
References () https://www.exploit-db.com/exploits/40135 - () https://www.exploit-db.com/exploits/40135 - Exploit, Third Party Advisory, VDB Entry
References () https://www.vulncheck.com/advisories/wowza-streaming-engine-multiple-cross-site-scripting-vulnerabilities - () https://www.vulncheck.com/advisories/wowza-streaming-engine-multiple-cross-site-scripting-vulnerabilities - Third Party Advisory
First Time Wowza
Wowza streaming Engine
CPE cpe:2.3:a:wowza:streaming_engine:4.5.0:*:*:*:*:*:*:*
Summary
  • (es) Wowza Streaming Engine 4.5.0 contiene múltiples vulnerabilidades de cross-site scripting reflejado en la interfaz enginemanager, donde la entrada pasada a través de varios parámetros no se sanea correctamente antes de ser devuelta a los usuarios. Los atacantes pueden inyectar código de script malicioso a través de parámetros como appName, vhost, uiAppType y wowzaCloudDestinationType en múltiples puntos finales para ejecutar HTML y JavaScript arbitrarios en la sesión del navegador de un usuario.

16 Mar 2026, 14:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-16 14:17

Updated : 2026-03-19 14:17

NVD link : CVE-2016-20036

Mitre link : CVE-2016-20036

CVE.ORG link : CVE-2016-20036

JSON object : View

Products Affected

wowza

  • streaming_engine
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')