Show filters
36 Total Results
Displaying 21-30 of 36
Sort by:
Attacker Value
Unknown
CVE-2017-5574
Disclosure Date: January 23, 2017 (last updated November 25, 2024)
SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows unauthenticated users to execute arbitrary SQL commands via the activation parameter.
0
Attacker Value
Unknown
CVE-2017-5575
Disclosure Date: January 23, 2017 (last updated November 25, 2024)
SQL injection vulnerability in inc/lib/Options.class.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the modules parameter.
0
Attacker Value
Unknown
CVE-2017-5515
Disclosure Date: January 17, 2017 (last updated November 25, 2024)
Cross-site scripting (XSS) vulnerability in the user prompt function in GeniXCMS through 0.0.8 allows remote authenticated users to inject arbitrary web script or HTML via tag names.
0
Attacker Value
Unknown
CVE-2017-5516
Disclosure Date: January 17, 2017 (last updated November 25, 2024)
Multiple cross-site scripting (XSS) vulnerabilities in the user forms in GeniXCMS through 0.0.8 allow remote attackers to inject arbitrary web script or HTML via crafted parameters.
0
Attacker Value
Unknown
CVE-2017-5518
Disclosure Date: January 17, 2017 (last updated November 25, 2024)
The media-file upload feature in GeniXCMS through 0.0.8 allows remote attackers to conduct SSRF attacks via a URL, as demonstrated by a URL with an intranet IP address.
0
Attacker Value
Unknown
CVE-2017-5517
Disclosure Date: January 17, 2017 (last updated November 25, 2024)
SQL injection vulnerability in author.control.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the type parameter.
0
Attacker Value
Unknown
CVE-2017-5520
Disclosure Date: January 17, 2017 (last updated November 25, 2024)
The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to rename and execute files with the `.php6`, `.php7` and `.phtml` extensions.
0
Attacker Value
Unknown
CVE-2017-5519
Disclosure Date: January 17, 2017 (last updated November 25, 2024)
SQL injection vulnerability in Posts.class.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the id parameter.
0
Attacker Value
Unknown
CVE-2017-5347
Disclosure Date: January 12, 2017 (last updated November 25, 2024)
SQL injection vulnerability in inc/mod/newsletter/options.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the recipient parameter to gxadmin/index.php.
0
Attacker Value
Unknown
CVE-2017-5346
Disclosure Date: January 12, 2017 (last updated November 25, 2024)
SQL injection vulnerability in inc/lib/Control/Backend/posts.control.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter to gxadmin/index.php.
0
