Skip to content
Noroxi

genixcms records

18 published records for vendor genixcms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
2
With a fix record
50%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

18 records
  • CVE-2017-8827
    36Monitor

    forgotpassword.php in GeniXCMS 1.0.2 lacks a rate limit, which might allow remote attackers to cause a denial of service (login inability) o

    CriticalCVSS 9.1No exploitEPSS 2%

    genixcms · genixcmsMay 8, 2017

  • CVE-2017-14764
    35Monitor

    In the Upload Modules page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of

    HighCVSS 8.8No exploitEPSS 2%

    genixcms · genixcmsSep 27, 2017

  • CVE-2017-8377
    35Monitor

    GeniXCMS 1.0.2 has SQL Injection in inc/lib/Control/Backend/menus.control.php via the menuid parameter.

    HighCVSS 8.8No exploitEPSS 1%

    genixcms · genixcmsMay 1, 2017

  • CVE-2017-14763
    35Monitor

    In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of

    HighCVSS 8.8No exploitEPSS 1%

    genixcms · genixcmsSep 27, 2017

  • CVE-2015-2679
    32Monitor

    Multiple SQL injection vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to execute arbitrary SQL commands via the

    HighCVSS 7.5Proof of conceptEPSS 6%

    genixcms · genixcmsMar 23, 2015

  • CVE-2016-10096
    29Monitor

    SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the activ

    HighCVSS 7.3No exploitEPSS 2%

    genixcms · genixcmsJan 1, 2017

  • CVE-2017-5346
    28Monitor

    SQL injection vulnerability in inc/lib/Control/Backend/posts.control.php in GeniXCMS 0.0.8 allows remote authenticated administrators to exe

    HighCVSS 7.2No exploitEPSS 2%

    genixcms · genixcmsJan 12, 2017

  • CVE-2017-14765
    24Monitor

    In GeniXCMS 1.1.4, gxadmin/index.php has XSS via the Menu ID field in a page=menus request.

    MediumCVSS 6.1No exploitEPSS 1%

    genixcms · genixcmsSep 27, 2017

  • CVE-2017-14761
    24Monitor

    In GeniXCMS 1.1.4, /inc/lib/backend/menus.control.php has XSS via the id parameter.

    MediumCVSS 6.1No exploitEPSS 1%

    genixcms · genixcmsSep 27, 2017

  • CVE-2017-14762
    24Monitor

    In GeniXCMS 1.1.4, /inc/lib/Control/Backend/menus.control.php has XSS via the id parameter.

    MediumCVSS 6.1No exploitEPSS 1%

    genixcms · genixcmsSep 27, 2017

  • CVE-2017-17431
    24Monitor

    GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, term, to, or token parameter.

    MediumCVSS 6.1No exploitEPSS 1%

    genixcms · genixcmsDec 5, 2017

  • CVE-2017-8388
    21Monitor

    GeniXCMS 1.0.2 allows remote attackers to bypass the alertDanger MSG_USER_EMAIL_EXIST protection mechanism via a register.php?act=edit&id=1

    MediumCVSS 5.3No exploitEPSS 2%

    genixcms · genixcmsMay 1, 2017

  • CVE-2017-14231
    21Monitor

    GeniXCMS before 1.1.0 allows remote attackers to cause a denial of service (account blockage) by leveraging the mishandling of certain usern

    MediumCVSS 5.3No exploitEPSS 1%

    genixcms · genixcmsSep 10, 2017

  • CVE-2017-8376
    21Monitor

    GeniXCMS 1.0.2 has XSS triggered by an authenticated comment that is mishandled during a mouse operation by an administrator.

    MediumCVSS 5.4No exploitEPSS 1%

    genixcms · genixcmsMay 1, 2017

  • CVE-2017-8762
    21Monitor

    GeniXCMS 1.0.2 has XSS triggered by an authenticated user who submits a page, as demonstrated by a crafted oncut attribute in a B element.

    MediumCVSS 5.4No exploitEPSS 0%

    genixcms · genixcmsMay 3, 2017

  • CVE-2015-2678
    19Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to inject arbitrary web scrip

    MediumCVSS 4.3Proof of conceptEPSS 5%

    genixcms · genixcmsMar 23, 2015

  • CVE-2017-14740
    19Monitor

    Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the

    MediumCVSS 4.8No exploitEPSS 1%

    genixcms · genixcmsApr 26, 2018

  • CVE-2017-8780
    19Monitor

    GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malfor

    MediumCVSS 4.8No exploitEPSS 1%

    genixcms · genixcmsMay 4, 2017