CVE-2016-10223

An issue was discovered in BigTree CMS before 4.2.15. The vulnerability exists due to insufficient filtration of user-supplied data in the "id" HTTP GET parameter passed to the "core/admin/adjax/dashboard/check-module-integrity.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

• CWE-284

• https://github.com/bigtreecms/BigTree-CMS/blob/master/README.mdIssue Tracking, Patch, Release Notes, Third Party Advisory
• https://github.com/bigtreecms/BigTree-CMS/commit/59ebef5978f80e2fdc7b4db4a28b668c5a39fbc3Issue Tracking, Patch, Third Party Advisory
• https://github.com/bigtreecms/BigTree-CMS/blob/master/README.mdIssue Tracking, Patch, Release Notes, Third Party Advisory
• https://github.com/bigtreecms/BigTree-CMS/commit/59ebef5978f80e2fdc7b4db4a28b668c5a39fbc3Issue Tracking, Patch, Third Party Advisory

Published

Feb 14, 2017

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-10218The pdf14_pop_transparency_group function in base/gdevp14.c …
• CVE-2016-10219The intersect function in base/gxfill.c in Artifex Software,…
• CVE-2016-1022Adobe Flash Player before 18.0.0.343 and 19.x through 21.x b…8.8
• CVE-2016-10220The gs_makewordimagedevice function in base/gsdevmem.c in Ar…
• CVE-2016-10221The count_entries function in pdf-layer.c in Artifex Softwar…4.3
• CVE-2016-10222runtime/JSONObject.cpp in JavaScriptCore in WebKit, as distr…
• CVE-2016-10224An issue was discovered in Sauter NovaWeb web HMI. The appli…7.2
• CVE-2016-10225The sunxi-debug driver in Allwinner 3.4 legacy kernel for H3…7.8
• CVE-2016-10226JavaScriptCore in WebKit, as distributed in Safari Technolog…
• CVE-2016-10227Zyxel USG50 Security Appliance and NWA3560-N Access Point al…
• CVE-2016-10228The iconv program in the GNU C Library (aka glibc or libc6) …
• CVE-2016-10229udp.c in the Linux kernel before 4.5 allows remote attackers…9.8