Vulnerabilities

TI-2022-08417 CVE-2022-24563 · GHSA-5mwx-f6w6-7w5r

In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in…

LOW 26

In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_title and intro_image parameters.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0088 Published 2022-03-03 No fix listed CWE-79

TI-2020-08114 CVE-2020-10057 · GHSA-fmgv-rqvg-5pqf

GeniXCMS 1.1.7 is vulnerable to user privilege escalation due to broken access control.

MEDIUM 40

GeniXCMS 1.1.7 is vulnerable to user privilege escalation due to broken access control.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00928 Published 2020-03-04 No fix listed CWE-352

TI-2018-10388 CVE-2018-14476 · GHSA-f6w6-j6qr-jg8v

GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation.

LOW 29

GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00874 Published 2019-12-31 No fix listed CWE-79

TI-2015-03324 CVE-2015-3933 · GHSA-q4hw-62mx-q37w

Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS…

MEDIUM 49

Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL commands via the (1) email parameter or (2) userid parameter to r…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0376 Published 2017-11-08 No fix listed CWE-89

TI-2017-03874 CVE-2017-5959 · GHSA-prq7-9jh2-2j66

CSRF token bypass in GeniXCMS before 1.0.2 could result in escalation of privileges.

MEDIUM 43

CSRF token bypass in GeniXCMS before 1.0.2 could result in escalation of privileges.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.00608 Published 2017-02-21 No fix listed CWE-352

TI-2017-03972 CVE-2017-6065 · GHSA-3pr7-m23m-xgmq

SQL injection vulnerability in inc/lib/Control/Backend/menus.control.php in GeniXCMS…

MEDIUM 40

SQL injection vulnerability in inc/lib/Control/Backend/menus.control.php in GeniXCMS through 1.0.2 allows remote authenticated users to execute arbitrary SQL commands via the order parameter.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01066 Published 2017-02-17 No fix listed CWE-89

TI-2017-03580 CVE-2017-5575 · GHSA-9xp9-c64p-p7qv

SQL injection vulnerability in inc/lib/Options.class.php in GeniXCMS before 1.0.0 allows…

MEDIUM 47

SQL injection vulnerability in inc/lib/Options.class.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the modules parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02914 Published 2017-01-23 No fix listed CWE-89

TI-2017-03579 CVE-2017-5574 · GHSA-hv7q-x2pj-jxxv

SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows…

MEDIUM 47

SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows unauthenticated users to execute arbitrary SQL commands via the activation parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02458 Published 2017-01-23 No fix listed CWE-89

TI-2017-03536 CVE-2017-5520 · GHSA-7vj3-pg62-q488

The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file…

MEDIUM 42

The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to rename and execute files with the `.php6`, `.php7…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01806 Published 2017-01-17 No fix listed CWE-434

TI-2017-03535 CVE-2017-5519 · GHSA-qwgp-67q7-76wr

SQL injection vulnerability in Posts.class.php in GeniXCMS through 0.0.8 allows remote…

MEDIUM 47

SQL injection vulnerability in Posts.class.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02521 Published 2017-01-17 No fix listed CWE-89

TI-2017-03534 CVE-2017-5518 · GHSA-v2j5-972j-h7cp

The media-file upload feature in GeniXCMS through 0.0.8 allows remote attackers to…

LOW 36

The media-file upload feature in GeniXCMS through 0.0.8 allows remote attackers to conduct SSRF attacks via a URL, as demonstrated by a URL with an intranet IP address.

CVSS 3.0HIGH 7.4 Network No auth User interaction EPSS 0.01564 Published 2017-01-17 No fix listed CWE-918

TI-2017-03533 CVE-2017-5517 · GHSA-3v45-w9r6-863p

SQL injection vulnerability in author.control.php in GeniXCMS through 0.0.8 allows remote…

MEDIUM 47

SQL injection vulnerability in author.control.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the type parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02521 Published 2017-01-17 No fix listed CWE-89

TI-2017-03532 CVE-2017-5516 · GHSA-vmhv-3pxh-pr9v

Multiple cross-site scripting (XSS) vulnerabilities in the user forms in GeniXCMS through…

LOW 30

Multiple cross-site scripting (XSS) vulnerabilities in the user forms in GeniXCMS through 0.0.8 allow remote attackers to inject arbitrary web script or HTML via crafted parameters.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01138 Published 2017-01-17 No fix listed CWE-79

TI-2017-03531 CVE-2017-5515 · GHSA-5chg-7fmp-5vgq

Cross-site scripting (XSS) vulnerability in the user prompt function in GeniXCMS through…

LOW 26

Cross-site scripting (XSS) vulnerability in the user prompt function in GeniXCMS through 0.0.8 allows remote authenticated users to inject arbitrary web script or HTML via tag names.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00791 Published 2017-01-17 No fix listed CWE-79

TI-2017-03388 CVE-2017-5347 · GHSA-mjrx-v73w-6p2j

SQL injection vulnerability in inc/mod/newsletter/options.php in GeniXCMS 0.0.8 allows…

LOW 35

SQL injection vulnerability in inc/mod/newsletter/options.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the recipient parameter to gxadmin/index.php.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.01414 Published 2017-01-12 No fix listed CWE-89

TI-2017-03386 CVE-2017-5345 · GHSA-xq54-mqmx-3733

SQL injection vulnerability in inc/lib/Control/Ajax/tags-ajax.control.php in GeniXCMS…

MEDIUM 41

SQL injection vulnerability in inc/lib/Control/Ajax/tags-ajax.control.php in GeniXCMS 0.0.8 allows remote authenticated editors to execute arbitrary SQL commands via the term parameter to the default URI.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01552 Published 2017-01-12 No fix listed CWE-89

TI-2015-04248 CVE-2015-5066 · GHSA-6fvr-rxw2-r84r

Multiple cross-site scripting (XSS) vulnerabilities in the MetalGenix GeniXCMS 0.0.3…

LOW 26

Multiple cross-site scripting (XSS) vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) content or (2) title field in an add action in the posts page…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03732 Published 2015-06-24 No fix listed CWE-79

TI-2015-02365 CVE-2015-2680 · GHSA-3w99-p52w-wfq4

Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2…

LOW 37

Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request in t…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.03907 Published 2015-03-23 No fix listed CWE-352

Vulnerabilities

Filters