What’s Vulnerable › Vulnerabilities

CVE-2016-20096: Linknat VOS3000/VOS2009 2.1.2.0 SQL Injection via login.jsp

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-21 · updated 2026-07-23
• Weakness: CWE-89

Description

Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the login form and retrieve injected query results from a subsequent session request, enabling extraction of plaintext credentials and other database content with DBA-level privileges.

Affected products

• Kunshi Network Technology Co., Ltd. Linknat VOS2009: 2.1.1.5, 2.1.1.8, 2.1.2.0
• Kunshi Network Technology Co., Ltd. Linknat VOS3000: 2.1.1.5, 2.1.1.8, 2.1.2.0

References

• https://packetstorm.news/files/id/137159
• https://web.archive.org/web/20160601102456/http://www.wooyun.org/bugs/wooyun-2010-0145458
• https://www.linknat.com/
• https://www.vulncheck.com/advisories/linknat-vos3000-vos2009-sql-injection-via-login-jsp

Get alerted when CVE-2016-20096 or the next vulnerability affects your stack