CVE-2016-10096 GeniXCMS SQL injection vulnerability

HighCVSS 7.3 EPSS 1.6%

Published: 2017-01-01 21:00
Updated: 2026-06-17 03:39
Exploit status: No public exploit known

Description

SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the activation parameter.

Affected products

Product	Affected versions	Fixed in
genix/cms(Packagist)	< 1.0.0	1.0.0
genixcms	<= 0.0.8	No fix listed

References

nvd.nist.gov third-party-advisory vendor-advisory
github.com
github.com patch
github.com product
www.hackersb.cn
95172 vdb-entry
github.com

CVSS v3.0

7.3 High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: Low

All scores (4)

v3.0 7.3 · nvd@nist.gov
v3.0 7.3 · osv:ghsa
v3.0 7.3 · github
v2.0 7.5 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.62% (percentile 76.5)
CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.