# genix/cms (Packagist) vulnerabilities 18 known vulnerabilities, with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/genix/cms ## Advisories (18) ### [CVE-2022-24563](https://cve.now/CVE-2022-24563): In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the… - Severity: Unrated - Published: Mar 3, 2022 - Affected: through 1.1.11. ### [CVE-2017-14740](https://cve.now/CVE-2017-14740): Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via… - Severity: Unrated - Published: Apr 26, 2018 - Affected: versions 1.1.0. ### [CVE-2017-17431](https://cve.now/CVE-2017-17431): GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, term, to, or token parameter. - Severity: Unrated - Published: Dec 5, 2017 - Affected: through 1.1.5. ### [CVE-2015-3933](https://cve.now/CVE-2015-3933): Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to… - Severity: Unrated - Published: Nov 8, 2017 - Affected: through 0.0.3. ### [CVE-2017-14765](https://cve.now/CVE-2017-14765): In GeniXCMS 1.1.4, gxadmin/index.php has XSS via the Menu ID field in a page=menus request. - Severity: Unrated - Published: Sep 27, 2017 - Affected: versions 1.1.4. ### [CVE-2017-14764](https://cve.now/CVE-2017-14764): In the Upload Modules page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive… - Severity: Unrated - Published: Sep 27, 2017 - Affected: versions 1.1.4. ### [CVE-2017-14763](https://cve.now/CVE-2017-14763): In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive… - Severity: Unrated - Published: Sep 27, 2017 - Affected: versions 1.1.4. ### [CVE-2017-14762](https://cve.now/CVE-2017-14762): In GeniXCMS 1.1.4, /inc/lib/Control/Backend/menus.control.php has XSS via the id parameter. - Severity: Unrated - Published: Sep 27, 2017 - Affected: versions 1.1.4. ### [CVE-2017-14761](https://cve.now/CVE-2017-14761): In GeniXCMS 1.1.4, /inc/lib/backend/menus.control.php has XSS via the id parameter. - Severity: Unrated - Published: Sep 27, 2017 - Affected: versions 1.1.4. ### [CVE-2017-14231](https://cve.now/CVE-2017-14231): GeniXCMS before 1.1.0 allows remote attackers to cause a denial of service (account blockage) by leveraging the mishandling of certain… - Severity: Unrated - Published: Sep 10, 2017 - Affected: fixed in 1.1.0. ### [CVE-2017-8827](https://cve.now/CVE-2017-8827): forgotpassword.php in GeniXCMS 1.0.2 lacks a rate limit, which might allow remote attackers to cause a denial of service (login inability)… - Severity: Unrated - Published: May 8, 2017 - Affected: fixed in 1.1.2. ### [CVE-2017-8780](https://cve.now/CVE-2017-8780): GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a… - Severity: Unrated - Published: May 4, 2017 - Affected: fixed in 1.1.0. ### [CVE-2017-8762](https://cve.now/CVE-2017-8762): GeniXCMS 1.0.2 has XSS triggered by an authenticated user who submits a page, as demonstrated by a crafted oncut attribute in a B element. - Severity: Unrated - Published: May 3, 2017 - Affected: fixed in 1.1.1. ### [CVE-2017-8388](https://cve.now/CVE-2017-8388): GeniXCMS 1.0.2 allows remote attackers to bypass the alertDanger MSG\_USER\_EMAIL\_EXIST protection mechanism via a… - Severity: Unrated - Published: May 1, 2017 - Affected: fixed in 1.1.0. ### [CVE-2017-8377](https://cve.now/CVE-2017-8377): GeniXCMS 1.0.2 has SQL Injection in inc/lib/Control/Backend/menus.control.php via the menuid parameter. - Severity: Unrated - Published: May 1, 2017 - Affected: fixed in 1.1.0. ### [CVE-2017-8376](https://cve.now/CVE-2017-8376): GeniXCMS 1.0.2 has XSS triggered by an authenticated comment that is mishandled during a mouse operation by an administrator. - Severity: Unrated - Published: May 1, 2017 - Affected: fixed in 1.1.0. ### [CVE-2017-5346](https://cve.now/CVE-2017-5346): SQL injection vulnerability in inc/lib/Control/Backend/posts.control.php in GeniXCMS 0.0.8 allows remote authenticated administrators to… - Severity: Unrated - Published: Jan 12, 2017 - Affected: fixed in 1.0.0. ### [CVE-2016-10096](https://cve.now/CVE-2016-10096): SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the… - Severity: Unrated - Published: Jan 1, 2017 - Affected: fixed in 1.0.0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/genix/cms Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.