Genixcms is a content-management system whose vulnerability profile concentrates in a single product and recurs through application-layer weaknesses including cross-site scripting, SQL injection, improper authentication, and code injection. The vendor's disclosures skew toward moderate-to-serious severity outcomes and have an elevated tendency to acquire public exploit code, reflecting the exposure surface inherent to web-facing CMS platforms. Defenders tracking this product should prioritize input-handling and authentication hardening; current severity, exploitation, and exposure figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Genixcms over time
Signals from CVEs in this vendor scope (18 CVEs).
18 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2015-2679HIGH Multiple SQL injection vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php or (2) u | Mar 23, 2015 | 7.5 | 30 | NO | YES |
CVE-2017-8827CRITICAL forgotpassword.php in GeniXCMS 1.0.2 lacks a rate limit, which might allow remote attackers to cause a denial of service (login inability) or possibly conduct Arbitrary User Passwo | May 8, 2017 | 9.1 | 29 | NO | NO |
CVE-2017-8377HIGH GeniXCMS 1.0.2 has SQL Injection in inc/lib/Control/Backend/menus.control.php via the menuid parameter. | May 1, 2017 | 8.8 | 28 | NO | NO |
CVE-2017-14763HIGH In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a theme. | Sep 27, 2017 | 8.8 | 27 | NO | NO |
CVE-2017-14764HIGH In the Upload Modules page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a module. | Sep 27, 2017 | 8.8 | 26 | NO | NO |
CVE-2017-5346HIGH SQL injection vulnerability in inc/lib/Control/Backend/posts.control.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the id p | Jan 12, 2017 | 7.2 | 25 | NO | NO |
CVE-2015-2678MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter in t | Mar 23, 2015 | 4.3 | 23 | NO | YES |
CVE-2017-14762MEDIUM In GeniXCMS 1.1.4, /inc/lib/Control/Backend/menus.control.php has XSS via the id parameter. | Sep 27, 2017 | 6.1 | 22 | NO | NO |
CVE-2017-14761MEDIUM In GeniXCMS 1.1.4, /inc/lib/backend/menus.control.php has XSS via the id parameter. | Sep 27, 2017 | 6.1 | 22 | NO | NO |
CVE-2017-17431MEDIUM GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, term, to, or token parameter. NOTE: this might overlap CVE-2017-14761, CVE-2017-14762, or CVE-2017-14765. | Dec 5, 2017 | 6.1 | 21 | NO | NO |
Signals from CVEs in this vendor scope (18 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Genixcms.
Media articles that mention a CVE ID that affects a product developed by Genixcms — matched by CVE ID, not by vendor name.