Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-24563: Genixcms XSS vulnerability in theme settings

CVE-2022-24563 · published 4 years ago

Summary

A security issue in Genixcms v1.1.11 allows an attacker to inject malicious code into the system by manipulating theme settings. This could potentially allow the attacker to steal user data or take control of the website. Update to the latest version of Genixcms to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
composer	genix	cms	<= 1.1.11
–	metalgenix	genixcms	1.1.11 `cpe:2.3:a:metalgenix:genixcms:1.1.11:::::::*`

Original advisory text

In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_title and intro_image parameters.

References

https://github.com/advisories/GHSA-5mwx-f6w6-7w5r
https://genix.me/ URL
https://github.com/truonghuuphuc/CVE/blob/main/CVE-2022-24563.pdf URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24563... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-24563 Vendor Advisory
https://github.com/truonghuuphuc/CVE Product

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.4 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published3 Mar 2022

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-5mwx-f6w6-7w5r · GHSA

CVE-2022-24563 · NVD

CVE-2022-24563 · OSV

Track software like this

Free during beta