Genesys develops a focused portfolio of customer-experience and contact-center management platforms, including products such as PureConnect, its Intelligent Workload Distribution Manager, and associated web and chat interfaces that handle customer interactions and administrative functions. The vendor's vulnerability footprint centers on application-layer input-handling weaknesses—cross-site scripting, SQL injection, and unrestricted file uploads—typical of web-facing and integration-heavy platforms where sanitization and validation boundaries become critical. Current severity and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Genesys over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-29930HIGH An issue was found in Genesys CIC Polycom phone provisioning TFTP Server all version allows a remote attacker to execute arbitrary code via the login crednetials to the TFTP server | May 10, 2023 | 8.8 | 27 | NO | NO |
CVE-2022-37775MEDIUM Genesys PureConnect Interaction Web Tools Chat Service (up to at least 26- September- 2019) allows XSS within the Printable Chat History via the participant -> name JSON POST param | Sep 16, 2022 | 6.1 | 24 | NO | NO |
CVE-2021-26787MEDIUM A cross site scripting (XSS) vulnerability in Genesys Workforce Management 8.5.214.20 can occur (during record deletion) via the Time-off parameter. | Dec 15, 2021 | 6.1 | 24 | NO | NO |
CVE-2021-40861HIGH A SQL Injection in the custom filter query component in Genesys intelligent Workload Distribution (IWD) 9.0.017.07 allows an attacker to execute arbitrary SQL queries via the value | Dec 8, 2021 | 7.2 | 24 | NO | NO |
CVE-2021-40860HIGH A SQL Injection in the custom filter query component in Genesys intelligent Workload Distribution (IWD) before 9.0.013.11 allows an attacker to execute arbitrary SQL queries via th | Dec 8, 2021 | 7.2 | 24 | NO | NO |
CVE-2019-17176MEDIUM Genesys PureEngage Digital (eServices) 8.1.x allows XSS via HtmlChatPanel.jsp or HtmlChatFrameSet.jsp (ActionColor, ClientNickNameColor, Email, email, or email_address parameter). | Oct 11, 2019 | 6.1 | 21 | NO | NO |
CVE-2023-23208MEDIUM Genesys Administrator Extension (GAX) before 9.0.105.15 is vulnerable to Cross Site Scripting (XSS) via the Business Structure page of the iWD plugin, aka GAX-11261. | Aug 13, 2023 | 6.1 | 20 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Genesys.
Media articles that mention a CVE ID that affects a product developed by Genesys — matched by CVE ID, not by vendor name.