CVE-2016-5072

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community Edition v4.9.9.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Apr 10, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-50736.1CloudView NMS before 2.10a has XSS via SNMP.CVE-2016-50749.8CloudView NMS before 2.10a has a format string issue exploitable over SNMP.CVE-2016-50756.1CloudView NMS before 2.10a has XSS via a TELNET login.CVE-2016-50767.5CloudView NMS before 2.10a allows remote attackers to obtain sensitive information via a direct request for admin/auto.def.CVE-2016-50776.1Netikus EventSentry before 3.2.1.44 has XSS via SNMP.CVE-2016-50786.1Paessler PRTG before 16.2.24.4045 has XSS via SNMP.CVE-2016-50809.8Integer overflow in the rtxMemHeapAlloc function in asn1rt_a.lib in Objective Systems ASN1C for C/C++ before 7.0.2 allows context-dependent CVE-2016-50819.8ZModo ZP-NE14-S and ZP-IBH-13W devices have a hardcoded root password, which makes it easier for remote attackers to obtain access via a TELCVE-2016-50847.5Johnson & Johnson Animas OneTouch Ping devices do not use encryption for certain data, which might allow remote attackers to obtain sensitivCVE-2016-50857.5Johnson & Johnson Animas OneTouch Ping devices do not properly generate random numbers, which makes it easier for remote attackers to spoof CVE-2016-50869.8Johnson & Johnson Animas OneTouch Ping devices allow remote attackers to bypass authentication via replay attacks.CVE-2016-50874.4Alertus Desktop Notification before 2.9.31.1710 on OS X uses weak permissions for configuration files and unspecified other files, which all
CVE-2016-5072: High severity, CVSS 8.8 | Vulnix