CVE-2017-8780: GeniXCMS Cross-site Scripting

genix/cms Updated 02 Oct 2025

Summary

17/05/2022

Disclosed on

CVE-2017-8780

CVE

Yes i

Fix available

Moderate

Severity

4.8

CVSS Score

CVE-2017-8780: GeniXCMS Cross-site Scripting. Affects genix/cms versions < 1.1.0. Fixed in 1.1.0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

GeniXCMS is a content management system (CMS) that allows users to create and manage websites. It provides features such as user management, page creation, and content publishing. The vulnerability in GeniXCMS version 1.0.2 allows for cross-site scripting (XSS) attacks. This means that an attacker can inject malicious code into the website, which can then be executed by unsuspecting users. The vulnerability occurs when a comment is mishandled during a publish operation by an administrator. This can lead to the execution of arbitrary code and potential data theft or manipulation.

Vulnerability Detail

The vulnerability in GeniXCMS version 1.0.2 is triggered by a comment that is not properly sanitized before being displayed on the website. This allows an attacker to inject malicious code, such as JavaScript, into the comment. When the comment is published by an administrator, the injected code is executed by the user's browser. This can lead to various attacks, including stealing sensitive information, session hijacking, or defacing the website. The vulnerability has a CVSS score of 4.8, indicating a moderate severity level.

How To Fix

Minimum fixed version

1.1.0

This is the first release that contains the fix.

composer require genix/cms:1.1.0

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

If upgrading to the latest version is not immediately possible, a temporary workaround is to disable comments on the website. This can be done by modifying the website's configuration or theme files to remove the comment functionality. By disabling comments, the potential attack vector is eliminated until the vulnerability can be fully addressed.

Conclusion

The GeniXCMS version 1.0.2 vulnerability allows for cross-site scripting (XSS) attacks, which can lead to the execution of arbitrary code and potential data theft or manipulation. It is crucial to upgrade to GeniXCMS version 1.1.0 or later to fix this vulnerability. If immediate upgrading is not possible, disabling comments on the website can serve as a temporary workaround. For more information and assistance, please contact DevNack.com.

See every vulnerability recorded for genix/cms →

FAQ

What is cross-site scripting (XSS)?

Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information or executing arbitrary code.

How does the GeniXCMS vulnerability affect my website?

If you are using GeniXCMS version 1.0.2, your website is vulnerable to cross-site scripting (XSS) attacks. An attacker can inject malicious code into comments, which can then be executed by users visiting the website. This can lead to data theft, session hijacking, or website defacement.

Is there a fix available for the GeniXCMS vulnerability?

Yes, the vulnerability can be fixed by upgrading to GeniXCMS version 1.1.0 or later. The updated version includes proper sanitization of comments, preventing the execution of injected code. It is recommended to update your GeniXCMS installation as soon as possible.

Can I temporarily mitigate the vulnerability without upgrading?

Yes, if upgrading to the latest version is not immediately possible, you can disable comments on your website. By removing the comment functionality, the potential attack vector is eliminated. However, this is only a temporary workaround, and it is still recommended to upgrade to the latest version.

Where can I find more information about the GeniXCMS vulnerability?

You can find more information about the GeniXCMS vulnerability, including the CVE identifier (CVE-2017-8780), on the official GitHub Advisory Database. Additionally, you can reach out to info@devnack.com for further support on vulnerability remediation.