CVE-2017-14762

In GeniXCMS 1.1.4, /inc/lib/Control/Backend/menus.control.php has XSS via the id parameter...

CVE-2017-14763

In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a theme...

Design/Logic Flaw

In GeniXCMS 1.1.4, /inc/lib/Control/Backend/menus.control.php has XSS via the id parameter...

CVE-2017-14765

In GeniXCMS 1.1.4, gxadmin/index.php has XSS via the Menu ID field in a page=menus request...

Design/Logic Flaw

In GeniXCMS 1.1.4, /inc/lib/backend/menus.control.php has XSS via the id parameter...

Design/Logic Flaw

In the Upload Modules page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a module...

CVE-2017-14762

In GeniXCMS 1.1.4, /inc/lib/Control/Backend/menus.control.php has XSS via the id parameter...

CVE-2017-14763

In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a theme...

CVE-2017-14762

In GeniXCMS 1.1.4, an XSS vulnerability exists in /inc/lib/Control/Backend/menus.control.php exploitable via the id parameter. The issue allows reflected/script-injected content in the affected page, as described by CVE-2017-14762. The provided documents do not specify the exact impact scope, exp...

CVE-2017-14762

In GeniXCMS 1.1.4, /inc/lib/Control/Backend/menus.control.php has XSS via the id parameter...

CVE-2017-14763

In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a theme...

CVE-2017-14765

CVE-2017-14765 corresponds to a cross-site scripting (XSS) issue in GeniXCMS 1.1.4. The vulnerability is reported as XSS via the Menu ID field in gxadmin/index.php when handling a page=menus request, indicating unsanitized input in that field. The connected advisories reference GeniXCMS 1.1.4/1.1...

CVE-2017-14764

CVE-2017-14764 affects GeniXCMS 1.1.4. The vulnerability allows remote authenticated users to execute arbitrary PHP code by placing a .php file inside a ZIP archive of a module uploaded via the Upload Modules page. The underlying issue is improper handling of module ZIP contents during extraction...

CVE-2017-14763

GeniXCMS 1.1.4 is affected by CVE-2017-14763: remote authenticated users can trigger arbitrary PHP code execution through a .php file in a Theme ZIP during the Install Themes process. The issue arises from how theme archives are handled, enabling code execution from uploaded theme files. This is ...

CVE-2017-14761

In GeniXCMS 1.1.4, /inc/lib/backend/menus.control.php has XSS via the id parameter...

CVE-2017-14761

Technical details about CVE-2017-14761 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2017-14765

In GeniXCMS 1.1.4, gxadmin/index.php has XSS via the Menu ID field in a page=menus request...

CVE-2017-14764

In the Upload Modules page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a module...

GeniXCMS /inc/lib/backend/menus.control.php file cross-site scripting vulnerability

MetalGenix GeniXCMS is a PHP-based content management system and framework CMSF from MetalGenix Indonesia, which provides modules for user management, content management and menu management. A cross-site scripting vulnerability exists in the /inc/lib/backend/menus.control.php file in MetalGenix...

GeniXCMS /inc/lib/Control/Backend/menus.control.php File Cross-Site Scripting Vulnerability

MetalGenix GeniXCMS is a PHP-based content management system and framework CMSF from MetalGenix Indonesia, which provides modules for user management, content management and menu management. A cross-site scripting vulnerability exists in the /inc/lib/Control/Backend/menus.control.php file in...