CVE-2016-5742

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-01-23 · updated 2026-06-17
Weakness: CWE-89

Description

SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before 6.2.6 and Movable Type Open Source 5.2.13 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Affected products

Six Apart Ltd. Movable Type: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5 (+9)
Sixapart Movable Type Open Source: through 5.2.13

References

http://www.openwall.com/lists/oss-security/2016/06/22/3
http://www.openwall.com/lists/oss-security/2016/06/22/5
http://www.openwall.com/lists/oss-security/2016/06/22/6
http://www.securitytracker.com/id/1036160
https://movabletype.org/news/2016/06/movable_type_626_and_613_released.html
http://www.openwall.com/lists/oss-security/2016/06/22/3
http://www.openwall.com/lists/oss-security/2016/06/22/5
http://www.openwall.com/lists/oss-security/2016/06/22/6
http://www.securitytracker.com/id/1036160
https://movabletype.org/news/2016/06/movable_type_626_and_613_released.html

Get alerted when CVE-2016-5742 or the next vulnerability affects your stack