Read the docs
TI-2016-04389 Aliases CVE-2016-5072GHSA-6r7w-whmg-2357

Code injection in OXID eShop before 2016-06-13

Priority MEDIUM 42CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community Edition v4.9.9.

Why it matters now

EPSS 0.01916 79th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—OXID eShop before 2016-06-13OXID eShop before 2016-06-13—No fix listedCNA
  • OXID eShop before 2016-06-13 Vendor— Affected OXID eShop before 2016-06-13 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:oxidforge:oxid_eshop:*:*:*:*:community:*:*:*up to 4.9.8VulnerableOxidforge
cpe:2.3:a:oxidforge:oxid_eshop:*:*:*:*:professional:*:*:*up to 4.9.8VulnerableOxidforge
cpe:2.3:a:oxidforge:oxid_eshop:*:*:*:*:enterprise:*:*:*up to 5.2.8VulnerableOxidforge
  • cpe:2.3:a:oxidforge:oxid_eshop:*:*:*:*:community:*:*:* Versions up to 4.9.8 Vulnerable ·Oxidforge
  • cpe:2.3:a:oxidforge:oxid_eshop:*:*:*:*:professional:*:*:* Versions up to 4.9.8 Vulnerable ·Oxidforge
  • cpe:2.3:a:oxidforge:oxid_eshop:*:*:*:*:enterprise:*:*:* Versions up to 5.2.8 Vulnerable ·Oxidforge

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-5072
  2. 2026-10-03 Alias added: GHSA-6r7w-whmg-2357

References

Patch 1

  • TI-2009-02967 Unspecified vulnerability in OXID eShop Professional, Enterprise, and Community Edition… CVSS 2.0HIGH 10.0
  • TI-2023-11422 OXID eShop 6.2.x before 6.4.4 and 6.5.x before 6.5.2 allows session hijacking, leading to… CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences