Metalgenix Genixcms
18 CVEs affecting Metalgenix Genixcms. Latest disclosed: 2022-03-03. Critical: 6, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-3933 | Critical | 9.8 | 2017-11-08 | Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL comm… |
CVE-2017-5959 | Critical | 9.8 | 2017-02-21 | CSRF token bypass in GeniXCMS before 1.0.2 could result in escalation of privileges. The forgotpassword.php page can be used to acquire a token. |
CVE-2017-5575 | Critical | 9.8 | 2017-01-23 | SQL injection vulnerability in inc/lib/Options.class.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the modules par… |
CVE-2017-5574 | Critical | 9.8 | 2017-01-23 | SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows unauthenticated users to execute arbitrary SQL commands via the activation paramete… |
CVE-2017-5519 | Critical | 9.8 | 2017-01-17 | SQL injection vulnerability in Posts.class.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
CVE-2017-5517 | Critical | 9.8 | 2017-01-17 | SQL injection vulnerability in author.control.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the type parameter. |
CVE-2020-10057 | High | 8.8 | 2020-03-04 | GeniXCMS 1.1.7 is vulnerable to user privilege escalation due to broken access control. This issue exists because of an incomplete fix for CVE-2015-2680, in wh… |
CVE-2017-6065 | High | 8.8 | 2017-02-17 | SQL injection vulnerability in inc/lib/Control/Backend/menus.control.php in GeniXCMS through 1.0.2 allows remote authenticated users to execute arbitrary SQL c… |
CVE-2017-5520 | High | 8.8 | 2017-01-17 | The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enable… |
CVE-2017-5345 | High | 8.8 | 2017-01-12 | SQL injection vulnerability in inc/lib/Control/Ajax/tags-ajax.control.php in GeniXCMS 0.0.8 allows remote authenticated editors to execute arbitrary SQL comman… |
CVE-2017-5518 | High | 7.4 | 2017-01-17 | The media-file upload feature in GeniXCMS through 0.0.8 allows remote attackers to conduct SSRF attacks via a URL, as demonstrated by a URL with an intranet IP… |
CVE-2017-5347 | High | 7.2 | 2017-01-12 | SQL injection vulnerability in inc/mod/newsletter/options.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands vi… |
CVE-2018-14476 | Medium | 6.1 | 2019-12-31 | GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation. |
CVE-2017-5516 | Medium | 6.1 | 2017-01-17 | Multiple cross-site scripting (XSS) vulnerabilities in the user forms in GeniXCMS through 0.0.8 allow remote attackers to inject arbitrary web script or HTML v… |
CVE-2022-24563 | Medium | 5.4 | 2022-03-03 | In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_title and intro_ima… |
CVE-2017-5515 | Medium | 5.4 | 2017-01-17 | Cross-site scripting (XSS) vulnerability in the user prompt function in GeniXCMS through 0.0.8 allows remote authenticated users to inject arbitrary web script… |
CVE-2015-5066 | | 2015-06-24 | Multiple cross-site scripting (XSS) vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1)… | |
CVE-2015-2680 | | 2015-03-23 | Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack the authentication of administrators for… |