CVE-2016-15022 — mosbth cimage check_system.php cross site scripting

Back Back to CVE browser

MEDIUM

mosbth cimage check_system.php cross site scripting

Published Jan 29, 2023

6.1

MEDIUM

CVSS 3.1

EPSS 0.50%

Description

A vulnerability was found in mosbth cimage up to 0.7.18. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file check_system.php. The manipulation of the argument $_SERVER['SERVER_SOFTWARE'] leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.7.19 is able to address this issue. The patch is named 401478c8393989836beeddfeac5ce44570af162b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-219715.

Affected products

Vendor Mosbth Product Cimage Default
n/a
- Version
  0.7.0
  Status
  affected
  Constraints
  -
- Version
  0.7.1
  Status
  affected
  Constraints
  -
- Version
  0.7.10
  Status
  affected
  Constraints
  -
- Version
  0.7.11
  Status
  affected
  Constraints
  -
- Version
  0.7.12
  Status
  affected
  Constraints
  -
- Version
  0.7.13
  Status
  affected
  Constraints
  -
- Version
  0.7.14
  Status
  affected
  Constraints
  -
- Version
  0.7.15
  Status
  affected
  Constraints
  -
- Version
  0.7.16
  Status
  affected
  Constraints
  -
- Version
  0.7.17
  Status
  affected
  Constraints
  -
- Version
  0.7.18
  Status
  affected
  Constraints
  -
- Version
  0.7.2
  Status
  affected
  Constraints
  -
- Version
  0.7.3
  Status
  affected
  Constraints
  -
- Version
  0.7.4
  Status
  affected
  Constraints
  -
- Version
  0.7.5
  Status
  affected
  Constraints
  -
- Version
  0.7.6
  Status
  affected
  Constraints
  -
- Version
  0.7.7
  Status
  affected
  Constraints
  -
- Version
  0.7.8
  Status
  affected
  Constraints
  -
- Version
  0.7.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mosbth

Cimage

n/a

Version	Status	Constraints
0.7.0	affected	-
0.7.1	affected	-
0.7.10	affected	-
0.7.11	affected	-
0.7.12	affected	-
0.7.13	affected	-
0.7.14	affected	-
0.7.15	affected	-
0.7.16	affected	-
0.7.17	affected	-
0.7.18	affected	-
0.7.2	affected	-
0.7.3	affected	-
0.7.4	affected	-
0.7.5	affected	-
0.7.6	affected	-
0.7.7	affected	-
0.7.8	affected	-
0.7.9	affected	-

Remediation

No remediation recorded yet.

Metrics

0.50% 0.00500

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00500

Score over time

2023–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.50% (0.00500)	40.56th	v5 (v2026.06.15)
Jun 15, 2026	0.50% (0.00496)	38.38th	v5 (v2026.06.15)
Mar 17, 2025	0.05% (0.00047)	11.62th	v4 (v2025.03.14)
Dec 12, 2024	0.12% (0.00123)	48.26th	v3 (v2023.03.01)
Jul 11, 2024	0.09% (0.00088)	38.32th	v3 (v2023.03.01)
Jul 3, 2024	0.08% (0.00080)	34.65th	v3 (v2023.03.01)
Mar 2, 2024	0.08% (0.00080)	32.65th	v3 (v2023.03.01)
Feb 5, 2024	0.07% (0.00074)	30.64th	v3 (v2023.03.01)
Dec 30, 2023	0.06% (0.00060)	23.43th	v3 (v2023.03.01)
Mar 7, 2023	0.05% (0.00052)	18.25th	v3 (v2023.03.01)
Mar 6, 2023	1.02% (0.01018)	40.69th	v2 (v2022.01.01)
Feb 8, 2023	1.02% (0.01018)	40.01th	v2 (v2022.01.01)
Jan 30, 2023	0.95% (0.00950)	31.71th	v2 (v2022.01.01)

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (6)

https://github.com/advisories/GHSA-6hv3-9fqx-8pg5
Advisory
https://github.com/mosbth/cimage/commit/401478c8393989836beeddfeac5ce44570af162b
patchThird Party Advisory
https://github.com/mosbth/cimage/releases/tag/v0.7.19
patchRelease NotesThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-15022
https://vuldb.com/?ctiid.219715
signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.219715
vdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-6hv3-9fqx-8pg5		Advisory
https://github.com/mosbth/cimage/commit/401478c8393989836beeddfeac5ce44570af162b		patchThird Party Advisory
https://github.com/mosbth/cimage/releases/tag/v0.7.19		patchRelease NotesThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-15022
https://vuldb.com/?ctiid.219715		signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.219715		vdb-entrytechnical-descriptionThird Party Advisory