CVE-2015-2678

medium

Description

Multiple cross-site scripting (XSS) vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter in the categories page to gxadmin/index.php or (2) page parameter to index.php.

References

https://github.com/semplon/GeniXCMS/issues/7

https://github.com/semplon/GeniXCMS/commit/698245488343396185b1b49e7482ee5b25541815

http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5233.php

http://www.securityfocus.com/bid/73301

http://osvdb.org/show/osvdb/119394

http://blog.metalgenix.com/genixcms-v0-0-2-release-security-and-bug-fixes/17

Details

Source: Mitre, NVD

Published: 2015-03-23

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Severity: Medium

EPSS

EPSS: 0.15832