PT-2017-16552

Name of the Vulnerable Software and Affected Versions GeniXCMS versions prior to 0.0.9 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the type parameter in the author.control.php file. Recommendations For GeniXCMS versions prior to 0.0.9,...

PT-2017-16555

Name of the Vulnerable Software and Affected Versions GeniXCMS versions 0.0.0 through 0.0.8 Description The issue concerns the media rename feature, which fails to account for alternative PHP file extensions when checking uploaded files for PHP content. This allows users to rename and execute fil...

CVE-2017-5515: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the user prompt function in GeniXCMS through 0.0.8 allows remote authenticated users to inject arbitrary web script or HTML via tag names...

CVE-2017-5516: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the user forms in GeniXCMS through 0.0.8 allow remote attackers to inject arbitrary web script or HTML via crafted parameters...

PT-2017-16550

Name of the Vulnerable Software and Affected Versions GeniXCMS versions prior to 0.0.9 Description A cross-site scripting XSS issue exists in the user prompt function, allowing remote authenticated users to inject arbitrary web script or HTML via tag names. Recommendations For versions prior to...

PT-2017-16551

Name of the Vulnerable Software and Affected Versions GeniXCMS versions prior to 0.0.9 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in user forms. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via crafted parameters...

CVE-2017-5518: Server-Side Request Forgery (SSRF)

The media-file upload feature in GeniXCMS through 0.0.8 allows remote attackers to conduct SSRF attacks via a URL, as demonstrated by a URL with an intranet IP address...

PT-2017-16553

Name of the Vulnerable Software and Affected Versions GeniXCMS versions prior to 0.0.9 Description The issue concerns the media-file upload feature, which allows remote attackers to conduct Server-Side Request Forgery SSRF attacks by providing a URL, potentially including intranet IP addresses...

MetalGenix GeniXCMS SQL Injection Vulnerability (CNVD-2017-00557)

MetalGenix GeniXCMS is a PHP-based content management system and framework CMSF from MetalGenix Indonesia, which provides modules for user management, content management and menu management. A SQL injection vulnerability exists in the inc/lib/Control/Ajax/tags-ajax.control.php file in MetalGenix...

MetalGenix GeniXCMS SQL Injection Vulnerability (CNVD-2017-00559)

MetalGenix GeniXCMS is a PHP-based content management system and framework CMSF from MetalGenix Indonesia, which provides modules for user management, content management and menu management. A SQL injection vulnerability exists in the inc/mod/newsletter/options.php file in MetalGenix GeniXCMS...

Sql injection

SQL injection vulnerability in inc/mod/newsletter/options.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the recipient parameter to gxadmin/index.php...

Sql injection

SQL injection vulnerability in inc/lib/Control/Ajax/tags-ajax.control.php in GeniXCMS 0.0.8 allows remote authenticated editors to execute arbitrary SQL commands via the term parameter to the default URI...

Sql injection

SQL injection vulnerability in inc/lib/Control/Backend/posts.control.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter to gxadmin/index.php...

CVE-2017-5345

SQL injection vulnerability in inc/lib/Control/Ajax/tags-ajax.control.php in GeniXCMS 0.0.8 allows remote authenticated editors to execute arbitrary SQL commands via the term parameter to the default URI...

CVE-2017-5345

SQL injection vulnerability in inc/lib/Control/Ajax/tags-ajax.control.php in GeniXCMS 0.0.8 allows remote authenticated editors to execute arbitrary SQL commands via the term parameter to the default URI...

CVE-2017-5347

SQL injection vulnerability in inc/mod/newsletter/options.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the recipient parameter to gxadmin/index.php...

CVE-2017-5347

SQL injection vulnerability in inc/mod/newsletter/options.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the recipient parameter to gxadmin/index.php...

CVE-2017-5346

SQL injection vulnerability in inc/lib/Control/Backend/posts.control.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter to gxadmin/index.php...

CVE-2017-5346

SQL injection vulnerability in inc/lib/Control/Backend/posts.control.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter to gxadmin/index.php...

CVE-2017-5345

SQL injection vulnerability in inc/lib/Control/Ajax/tags-ajax.control.php in GeniXCMS 0.0.8 allows remote authenticated editors to execute arbitrary SQL commands via the term parameter to the default URI...