CVE-2017-5516

Multiple cross-site scripting XSS vulnerabilities in the user forms in GeniXCMS through 0.0.8 allow remote attackers to inject arbitrary web script or HTML via crafted parameters...

Sql injection

SQL injection vulnerability in author.control.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the type parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the user prompt function in GeniXCMS through 0.0.8 allows remote authenticated users to inject arbitrary web script or HTML via tag names...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the user forms in GeniXCMS through 0.0.8 allow remote attackers to inject arbitrary web script or HTML via crafted parameters...

CVE-2017-5515

Cross-site scripting XSS vulnerability in the user prompt function in GeniXCMS through 0.0.8 allows remote authenticated users to inject arbitrary web script or HTML via tag names...

CVE-2017-5520

The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to rename and execute files with the .php6, .php7 and .phtml extensions...

CVE-2017-5518

The media-file upload feature in GeniXCMS through 0.0.8 allows remote attackers to conduct SSRF attacks via a URL, as demonstrated by a URL with an intranet IP address...

CVE-2017-5519

SQL injection vulnerability in Posts.class.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2017-5519

SQL injection vulnerability in Posts.class.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2017-5516

Multiple cross-site scripting XSS vulnerabilities in the user forms in GeniXCMS through 0.0.8 allow remote attackers to inject arbitrary web script or HTML via crafted parameters...

CVE-2017-5517

SQL injection vulnerability in author.control.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the type parameter...

CVE-2017-5520

The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to rename and execute files with the .php6, .php7 and .phtml extensions...

CVE-2017-5515

Cross-site scripting XSS vulnerability in the user prompt function in GeniXCMS through 0.0.8 allows remote authenticated users to inject arbitrary web script or HTML via tag names...

CVE-2017-5518

GeniXCMS media-file upload feature up to version 0.0.8 is affected by an SSRF vulnerability. The issue arises when the upload mechanism processes a URL, enabling remote attackers to fetch internal network resources (e.g., intranet addresses). The CVE description consistently states SSRF via a URL...

CVE-2017-5516

CVE-2017-5516 corresponds to multiple reflected XSS vulnerabilities in GeniXCMS user forms up to version 0.0.8. The CNVD-2017-00738 entry describes a cross-site scripting flaw allowing a remote attacker to inject arbitrary script or HTML via crafted parameters. The CNVD entry and related records ...

CVE-2017-5515

GeniXCMS (PHP-based CMS) has a cross-site scripting (XSS) vulnerability in the user prompt function up to version 0.0.8. An authenticated remote attacker can inject arbitrary script/HTML via tag names, enabling potential impact on user sessions or displayed content. Some connected sources specifi...

CVE-2017-5520

CVE-2017-5520 affects GeniXCMS up to version 0.0.8. The issue is in the media rename feature, which does not consider alternative PHP file extensions when checking uploaded files for PHP content, allowing an attacker to rename and execute files with .php6, .php7, or .phtml extensions. The connect...

CVE-2017-5517

The CVE-2017-5517 entry targets GeniXCMS (author.control.php) with a SQL injection via the type parameter, allowing remote execution of arbitrary SQL commands. Affected component is the GeniXCMS PHP-based CMS framework (up to version 0.0.8). The connected CNVD/NVD entries confirm the vulnerabilit...

CVE-2017-5516

Multiple cross-site scripting XSS vulnerabilities in the user forms in GeniXCMS through 0.0.8 allow remote attackers to inject arbitrary web script or HTML via crafted parameters...

CVE-2017-5515

Cross-site scripting XSS vulnerability in the user prompt function in GeniXCMS through 0.0.8 allows remote authenticated users to inject arbitrary web script or HTML via tag names...