Genixcms Security Vulnerabilities and Issues — Genixcms CVE List

Lucene search

MetalgenixGenixcms

4 matches found

CVE•added 2020/03/04 7:15 p.m.•56 views

CVE-2020-10057

GeniXCMS 1.1.7 is vulnerable to user privilege escalation due to broken access control. This issue exists because of an incomplete fix for CVE-2015-2680, in which "token" is used as a CSRF protection mechanism, but without validation that "token" is associated with an administrative user.

8.8CVSS8.8AI score0.01789EPSS

CVE•added 2017/01/17 9:59 a.m.•39 views

CVE-2017-5520

The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to rename and execute files with the .php6, .php7 and .phtml extensions.

8.8CVSS8.7AI score0.00525EPSS

CVE•added 2017/02/17 8:59 p.m.•34 views

CVE-2017-6065

SQL injection vulnerability in inc/lib/Control/Backend/menus.control.php in GeniXCMS through 1.0.2 allows remote authenticated users to execute arbitrary SQL commands via the order parameter.

8.8CVSS8.8AI score0.00344EPSS

CVE•added 2017/01/12 6:59 a.m.•32 views

CVE-2017-5345

SQL injection vulnerability in inc/lib/Control/Ajax/tags-ajax.control.php in GeniXCMS 0.0.8 allows remote authenticated editors to execute arbitrary SQL commands via the term parameter to the default URI.

8.8CVSS8.8AI score0.00428EPSS