Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
194 results · page 3 of 4
Jun 4, 2021BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery (CSRF) via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=editor' to change anyCVE-2020-36140 · Other software · Bloofox · reported by MITREMedium 6.5
BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery (CSRF) via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=editor' to change any file content (Locally/Remotely).
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2021BloofoxCMS 0.5.2.1 allows Reflected Cross-Site Scripting (XSS) vulnerability by inserting a XSS payload within the 'fileurl' parameter.CVE-2020-36139 · Other software · Bloofox · reported by MITREMedium 5.4
BloofoxCMS 0.5.2.1 allows Reflected Cross-Site Scripting (XSS) vulnerability by inserting a XSS payload within the 'fileurl' parameter.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2020bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: application/octet-stream") to ../media/images/ via the admin/index.php?modeCVE-2020-35709 · Other software · Bloofox · reported by MITREMedium 4.9
bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: application/octet-stream") to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2020AtomXCMS 2.0 is affected by Arbitrary File Read via admin/dump.phpCVE-2020-26650 · Other software · Atomx · reported by MITREMedium 5.3
AtomXCMS 2.0 is affected by Arbitrary File Read via admin/dump.php
- Product
- Atomxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2020AtomXCMS 2.0 is affected by Incorrect Access Control via admin/dump.phpCVE-2020-26649 · Other software · Atomx · reported by MITREHigh 8.1
AtomXCMS 2.0 is affected by Incorrect Access Control via admin/dump.php
- Product
- Atomxcms 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2020GeniXCMS 1.1.7 is vulnerable to user privilege escalation due to broken access control.CVE-2020-10057 · Other software · Metalgenix · reported by MITREHigh 8.8
GeniXCMS 1.1.7 is vulnerable to user privilege escalation due to broken access control. This issue exists because of an incomplete fix for CVE-2015-2680, in which "token" is used as a CSRF protection mechanism, but without validation that "token" is associated with an administrative user.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2019GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation.CVE-2018-14476 · Other software · Metalgenix · reported by MITREMedium 6.1
GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 20, 2019In Jspxcms 9.0.0, a vulnerable URL routing implementation allows remote code execution after logging in as web admin.CVE-2018-16553 · Other software · Jspxcms · reported by MITREHigh 7.2
In Jspxcms 9.0.0, a vulnerable URL routing implementation allows remote code execution after logging in as web admin.
- Product
- Jspxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2018Jspxcms v9.0.0 allows SSRF.CVE-2018-20596 · Other software · Jspxcms · reported by MITRECritical 9.8
Jspxcms v9.0.0 allows SSRF.
- Product
- Jspxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2018In YXcms 1.4.7, protected/apps/appmanage/controller/indexController.php allow remote authenticated Administrators to execute any PHP code by creating a ZIP archCVE-2018-19404 · Other software · Yxcms · reported by MITREHigh 7.2
In YXcms 1.4.7, protected/apps/appmanage/controller/indexController.php allow remote authenticated Administrators to execute any PHP code by creating a ZIP archive containing a config.php file, hosting the .zip file at an external URL, and visiting index.php?r=appmanage/index/onlineinstall&url= followed by that URL. This is related to the onlineinstall and import functions.
- Product
- Yxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2018protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=admin/photo/delpic picnCVE-2018-13025 · Other software · Yxcms · reported by MITREMedium 4.9
protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=admin/photo/delpic picname parameter.
- Product
- Yxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2018An issue was discovered in YXcms 1.4.7.CVE-2018-11003 · Other software · Yxcms · reported by MITREMedium 6.5
An issue was discovered in YXcms 1.4.7. Cross-site request forgery (CSRF) vulnerability in protected/apps/admin/controller/adminController.php allows remote attackers to delete administrator accounts via index.php?r=admin/admin/admindel.
- Product
- Yxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2018Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the Menu ID when adding CVE-2017-14740 · Other software · Genixcms · reported by MITREMedium 4.8
Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the Menu ID when adding a menu.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2018Yxcms building system (compatible cell phone) v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extend_guestbook.php or protected\CVE-2018-8805 · Other software · Yxcms · reported by MITREMedium 6.1
Yxcms building system (compatible cell phone) v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extend_guestbook.php or protected\apps\default\view\mobile\extend_guestbook.php in an index.php?r=default/column/index&col=guestbook request.
- Product
- Yxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2018protected\apps\member\controller\shopcarController.php in Yxcms building system (compatible cell phone) v1.4.7 has a logic flaw allowing attackers to modify a pCVE-2018-8761 · Other software · Yxcms · reported by MITREHigh 7.5
protected\apps\member\controller\shopcarController.php in Yxcms building system (compatible cell phone) v1.4.7 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture.
- Product
- Yxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2017GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, term, to, or token parameter.CVE-2017-17431 · Other software · Genixcms · reported by MITREMedium 6.1
GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, term, to, or token parameter. NOTE: this might overlap CVE-2017-14761, CVE-2017-14762, or CVE-2017-14765.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Nov 8, 2017Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL commaCVE-2015-3933 · Other software · Metalgenix · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL commands via the (1) email parameter or (2) userid parameter to register.php.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Sep 27, 2017In GeniXCMS 1.1.4, gxadmin/index.php has XSS via the Menu ID field in a page=menus request.CVE-2017-14765 · Other software · Genixcms · reported by MITREMedium 6.1
In GeniXCMS 1.1.4, gxadmin/index.php has XSS via the Menu ID field in a page=menus request.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2017In the Upload Modules page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a module.CVE-2017-14764 · Other software · Genixcms · reported by MITREHigh 8.8
In the Upload Modules page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a module.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2017In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a theme.CVE-2017-14763 · Other software · Genixcms · reported by MITREHigh 8.8
In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a theme.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2017In GeniXCMS 1.1.4, /inc/lib/Control/Backend/menus.control.php has XSS via the id parameter.CVE-2017-14762 · Other software · Genixcms · reported by MITREMedium 6.1
In GeniXCMS 1.1.4, /inc/lib/Control/Backend/menus.control.php has XSS via the id parameter.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2017In GeniXCMS 1.1.4, /inc/lib/backend/menus.control.php has XSS via the id parameter.CVE-2017-14761 · Other software · Genixcms · reported by MITREMedium 6.1
In GeniXCMS 1.1.4, /inc/lib/backend/menus.control.php has XSS via the id parameter.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2017GeniXCMS before 1.1.0 allows remote attackers to cause a denial of service (account blockage) by leveraging the mishandling of certain username substring relatiCVE-2017-14231 · Other software · Genixcms · reported by MITREMedium 5.3
GeniXCMS before 1.1.0 allows remote attackers to cause a denial of service (account blockage) by leveraging the mishandling of certain username substring relationships, such as the admin<script> username versus the admin username, related to register.php, User.class.php, and Type.class.php.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2017forgotpassword.php in GeniXCMS 1.0.2 lacks a rate limit, which might allow remote attackers to cause a denial of service (login inability) or possibly conduct ACVE-2017-8827 · Other software · Genixcms · reported by MITRECritical 9.1
forgotpassword.php in GeniXCMS 1.0.2 lacks a rate limit, which might allow remote attackers to cause a denial of service (login inability) or possibly conduct Arbitrary User Password Reset attacks via a series of requests.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2017GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malformed P element.CVE-2017-8780 · Other software · Genixcms · reported by MITREMedium 4.8
GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malformed P element.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2017GeniXCMS 1.0.2 has XSS triggered by an authenticated user who submits a page, as demonstrated by a crafted oncut attribute in a B element.CVE-2017-8762 · Other software · Genixcms · reported by MITREMedium 5.4
GeniXCMS 1.0.2 has XSS triggered by an authenticated user who submits a page, as demonstrated by a crafted oncut attribute in a B element.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2017GeniXCMS 1.0.2 allows remote attackers to bypass the alertDanger MSG_USER_EMAIL_EXIST protection mechanism via a register.php?act=edit&id=1 request.CVE-2017-8388 · Other software · Genixcms · reported by MITREMedium 5.3
GeniXCMS 1.0.2 allows remote attackers to bypass the alertDanger MSG_USER_EMAIL_EXIST protection mechanism via a register.php?act=edit&id=1 request.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2017GeniXCMS 1.0.2 has SQL Injection in inc/lib/Control/Backend/menus.control.php via the menuid parameter.CVE-2017-8377 · Other software · Genixcms · reported by MITREHigh 8.8
GeniXCMS 1.0.2 has SQL Injection in inc/lib/Control/Backend/menus.control.php via the menuid parameter.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2017GeniXCMS 1.0.2 has XSS triggered by an authenticated comment that is mishandled during a mouse operation by an administrator.CVE-2017-8376 · Other software · Genixcms · reported by MITREMedium 5.4
GeniXCMS 1.0.2 has XSS triggered by an authenticated comment that is mishandled during a mouse operation by an administrator.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2017CSRF token bypass in GeniXCMS before 1.0.2 could result in escalation of privileges.CVE-2017-5959 · Other software · Metalgenix · reported by MITRECritical 9.8
CSRF token bypass in GeniXCMS before 1.0.2 could result in escalation of privileges. The forgotpassword.php page can be used to acquire a token.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2017SQL injection vulnerability in inc/lib/Control/Backend/menus.control.php in GeniXCMS through 1.0.2 allows remote authenticated users to execute arbitrary SQL coCVE-2017-6065 · Other software · Metalgenix · reported by MITREHigh 8.8
SQL injection vulnerability in inc/lib/Control/Backend/menus.control.php in GeniXCMS through 1.0.2 allows remote authenticated users to execute arbitrary SQL commands via the order parameter.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2017SQL injection vulnerability in inc/lib/Options.class.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the modules paraCVE-2017-5575 · Other software · Metalgenix · reported by MITRECritical 9.8
SQL injection vulnerability in inc/lib/Options.class.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the modules parameter.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jan 23, 2017SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows unauthenticated users to execute arbitrary SQL commands via the activation parameterCVE-2017-5574 · Other software · Metalgenix · reported by MITRECritical 9.8
SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows unauthenticated users to execute arbitrary SQL commands via the activation parameter.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jan 17, 2017The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enablesCVE-2017-5520 · Other software · Metalgenix · reported by MITREHigh 8.8
The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to rename and execute files with the `.php6`, `.php7` and `.phtml` extensions.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jan 17, 2017SQL injection vulnerability in Posts.class.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2017-5519 · Other software · Metalgenix · reported by MITRECritical 9.8
SQL injection vulnerability in Posts.class.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the id parameter.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jan 17, 2017The media-file upload feature in GeniXCMS through 0.0.8 allows remote attackers to conduct SSRF attacks via a URL, as demonstrated by a URL with an intranet IP CVE-2017-5518 · Other software · Metalgenix · reported by MITREHigh 7.4
The media-file upload feature in GeniXCMS through 0.0.8 allows remote attackers to conduct SSRF attacks via a URL, as demonstrated by a URL with an intranet IP address.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jan 17, 2017SQL injection vulnerability in author.control.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the type parameter.CVE-2017-5517 · Other software · Metalgenix · reported by MITRECritical 9.8
SQL injection vulnerability in author.control.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the type parameter.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jan 17, 2017Multiple cross-site scripting (XSS) vulnerabilities in the user forms in GeniXCMS through 0.0.8 allow remote attackers to inject arbitrary web script or HTML viCVE-2017-5516 · Other software · Metalgenix · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the user forms in GeniXCMS through 0.0.8 allow remote attackers to inject arbitrary web script or HTML via crafted parameters.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jan 17, 2017Cross-site scripting (XSS) vulnerability in the user prompt function in GeniXCMS through 0.0.8 allows remote authenticated users to inject arbitrary web script CVE-2017-5515 · Other software · Metalgenix · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in the user prompt function in GeniXCMS through 0.0.8 allows remote authenticated users to inject arbitrary web script or HTML via tag names.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jan 12, 2017SQL injection vulnerability in inc/mod/newsletter/options.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands viaCVE-2017-5347 · Other software · Metalgenix · reported by MITREHigh 7.2
SQL injection vulnerability in inc/mod/newsletter/options.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the recipient parameter to gxadmin/index.php.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jan 12, 2017SQL injection vulnerability in inc/lib/Control/Backend/posts.control.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL cCVE-2017-5346 · Other software · Genixcms · reported by MITREHigh 7.2
SQL injection vulnerability in inc/lib/Control/Backend/posts.control.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter to gxadmin/index.php.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comsecurityfocus.com
Jan 12, 2017SQL injection vulnerability in inc/lib/Control/Ajax/tags-ajax.control.php in GeniXCMS 0.0.8 allows remote authenticated editors to execute arbitrary SQL commandCVE-2017-5345 · Other software · Metalgenix · reported by MITREHigh 8.8
SQL injection vulnerability in inc/lib/Control/Ajax/tags-ajax.control.php in GeniXCMS 0.0.8 allows remote authenticated editors to execute arbitrary SQL commands via the term parameter to the default URI.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jan 1, 2017SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the activation parameter.CVE-2016-10096 · Other software · Genixcms · reported by MITREHigh 7.3
SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the activation parameter.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackersb.cnsecurityfocus.com
Jun 24, 2015Multiple cross-site scripting (XSS) vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) cCVE-2015-5066 · Other software · Metalgenix · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) content or (2) title field in an add action in the posts page to index.php or the (3) q parameter in the posts page to index.php.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhyp3rlinx.altervista.orgpacketstormsecurity.com
Mar 23, 2015Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack the authentication of administrators for rCVE-2015-2680 · Other software · Metalgenix · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request in the users page to gxadmin/index.php.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.metalgenix.comblog.metalgenix.com
Mar 23, 2015Multiple SQL injection vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) page parameter tCVE-2015-2679 · Other software · Genixcms · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php or (2) username parameter to gxadmin/login.php.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.metalgenix.comblog.metalgenix.com
Mar 23, 2015Multiple cross-site scripting (XSS) vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1CVE-2015-2678 · Other software · Genixcms · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter in the categories page to gxadmin/index.php or (2) page parameter to index.php.
- Product
- Genixcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.metalgenix.comosvdb.org
Sep 18, 2012Multiple cross-site request forgery (CSRF) vulnerabilities in FlexCMS 3.2.1 and earlier allow remote attackers to (1) hijack the authentication of users for reqCVE-2012-1901 · Other software · Flexcms · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in FlexCMS 3.2.1 and earlier allow remote attackers to (1) hijack the authentication of users for requests that change account settings via a request to index.php/profile-edit-save or (2) hijack the authentication of administrators for requests that add a new page via a request to admin/pages-new-save.
- Product
- Flexcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordivanobinetti.blogspot.comsecunia.com
Oct 7, 2011SQL injection vulnerability in index.php in BloofoxCMS 0.3.5 allows remote attackers to execute arbitrary SQL commands via the gender parameter.CVE-2010-4870 · Other software · Bloofox · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in BloofoxCMS 0.3.5 allows remote attackers to execute arbitrary SQL commands via the gender parameter.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgsecurityreason.com
Feb 1, 2011Multiple cross-site scripting (XSS) vulnerabilities in ModX Evolution before 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) insCVE-2011-0741 · Other software · Modxcms · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in ModX Evolution before 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) installer or (2) image editor.
- Product
- Evolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmodxcms.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.