CVE-2016-15022

mosbth cimage check_system.php cross site scripting

Low2.0EPSS 0.50%

Published: 29 Jan 2023
Updated: 27 Mar 2025
Reserved: 28 Jan 2023
Assigned by: VulDB

Description

A vulnerability was found in mosbth cimage up to 0.7.18. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file check_system.php. The manipulation of the argument $_SERVER['SERVER_SOFTWARE'] leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.7.19 is able to address this issue. The patch is named 401478c8393989836beeddfeac5ce44570af162b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-219715.

Scores

CVSS scores of CVE-2016-15022, by who scored it
Scored by	CVSS	Score	Vector
VulDBCNA (assigner)	3.1	Low2.0	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
VulDBCNA (assigner)	3.0	Low2.0	CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
VulDBCNA (assigner)	2.0	Low1.7	AV:N/AC:H/Au:M/C:N/I:P/A:N
NVDNVD · Modified	3.1	Medium6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS (exploitation in 30 days): 0.50% · top 57% of all CVEs (4 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.0.

Weakness

CWE-79 Cross Site Scripting (opens in a new tab)All about CWE-79 and its CVEs

Affected products

mosbth · cimage
- affected 0.7.0
- affected 0.7.1
- affected 0.7.2
- affected 0.7.3
- affected 0.7.4
- affected 0.7.5
- affected 0.7.6
- affected 0.7.7
- affected 0.7.8
- affected 0.7.9
- affected 0.7.10
- affected 0.7.11
- affected 0.7.12
- affected 0.7.13
- affected 0.7.14
- affected 0.7.15
- affected 0.7.16
- affected 0.7.17
- affected 0.7.18

Affected packages

From reviewed advisories of the GitHub Advisory Database.

Packagistmos/cimageGHSA-6hv3-9fqx-8pg5 (opens in a new tab)

References (4)

https://vuldb.com/?id.219715 (opens in a new tab)vdb-entrytechnical-descriptionx_transferred
https://vuldb.com/?ctiid.219715 (opens in a new tab)signaturepermissions-requiredx_transferred
https://github.com/mosbth/cimage/commit/401478c8393989836beeddfeac5ce44570af162b (opens in a new tab)patchx_transferred
https://github.com/mosbth/cimage/releases/tag/v0.7.19 (opens in a new tab)patchx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2016-15022](https://trackcve.app/badge/CVE-2016-15022.svg)](https://trackcve.app/cve/CVE-2016-15022)

Record last updated 27 Mar 2025, 19:30 UTC.