What’s Vulnerable › Vulnerabilities

CVE-2016-20036: Wowza Streaming Engine 4.5.0 Multiple Cross-Site Scripting Vulnerabilities

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-16 · updated 2026-06-17
• Weakness: CWE-79

Description

Wowza Streaming Engine 4.5.0 contains multiple reflected cross-site scripting vulnerabilities in the enginemanager interface where input passed through various parameters is not properly sanitized before being returned to users. Attackers can inject malicious script code through parameters like appName, vhost, uiAppType, and wowzaCloudDestinationType in multiple endpoints to execute arbitrary HTML and JavaScript in a user's browser session.

Affected products

• Wowza Streaming Engine: 4.5.0

References

• http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5343.php
• https://www.exploit-db.com/exploits/40135
• https://www.vulncheck.com/advisories/wowza-streaming-engine-multiple-cross-site-scripting-vulnerabilities

Get alerted when CVE-2016-20036 or the next vulnerability affects your stack