CVE-2016-1222

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-06-05 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in Kobe Beauty php-contact-form before 2016-05-18 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.

Affected products

Kobe-Beauty Php-Contact-Form: before 2016-05-18 — fixed in 2016-05-18

How to fix

Upgrade to a fixed version: Kobe-Beauty Php-Contact-Form 2016-05-18. Check the vendor advisory for mitigations.

References

http://jvn.jp/en/jp/JVN85112513/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000070
http://www.kobe-beauty.co.jp/php-contact-form/
https://github.com/kobebeauty/php-contact-form/commit/e7d094ca8ab15215c32d6fa04d17e8519c8d21cf
http://jvn.jp/en/jp/JVN85112513/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000070
http://www.kobe-beauty.co.jp/php-contact-form/
https://github.com/kobebeauty/php-contact-form/commit/e7d094ca8ab15215c32d6fa04d17e8519c8d21cf

Get alerted when CVE-2016-1222 or the next vulnerability affects your stack