Metalgenix's vulnerability footprint centers on GenixCMS, a web content-management platform, and skews strongly toward critical-severity outcomes across its disclosure history. The vendor's vulnerabilities recur through application-layer weakness classes including SQL injection, cross-site scripting, cross-site request forgery, server-side request forgery, and unrestricted file uploads—a pattern typical of web frameworks where input handling and request validation are attack-critical surfaces. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Metalgenix over time
Signals from CVEs in this vendor scope (18 CVEs).
18 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2015-3933CRITICAL Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL commands via the (1) emai | Nov 8, 2017 | 9.8 | 38 | NO | YES |
CVE-2017-5574CRITICAL SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows unauthenticated users to execute arbitrary SQL commands via the activation parameter. | Jan 23, 2017 | 9.8 | 32 | NO | NO |
CVE-2017-5520HIGH The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to rename an | Jan 17, 2017 | 8.8 | 30 | NO | NO |
CVE-2017-5345HIGH SQL injection vulnerability in inc/lib/Control/Ajax/tags-ajax.control.php in GeniXCMS 0.0.8 allows remote authenticated editors to execute arbitrary SQL commands via the term param | Jan 12, 2017 | 8.8 | 28 | NO | NO |
CVE-2017-6065HIGH SQL injection vulnerability in inc/lib/Control/Backend/menus.control.php in GeniXCMS through 1.0.2 allows remote authenticated users to execute arbitrary SQL commands via the order | Feb 17, 2017 | 8.8 | 27 | NO | NO |
CVE-2017-5519CRITICAL SQL injection vulnerability in Posts.class.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the id parameter. | Jan 17, 2017 | 9.8 | 27 | NO | NO |
CVE-2015-5066MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) content or (2) title | Jun 24, 2015 | 4.3 | 27 | NO | YES |
CVE-2015-2680MEDIUM Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an | Mar 23, 2015 | 6.8 | 27 | NO | YES |
CVE-2017-5575CRITICAL SQL injection vulnerability in inc/lib/Options.class.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the modules parameter. | Jan 23, 2017 | 9.8 | 25 | NO | NO |
CVE-2017-5517CRITICAL SQL injection vulnerability in author.control.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the type parameter. | Jan 17, 2017 | 9.8 | 25 | NO | NO |
Signals from CVEs in this vendor scope (18 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Metalgenix.
Media articles that mention a CVE ID that affects a product developed by Metalgenix — matched by CVE ID, not by vendor name.