CVE-2016-20096
Linknat VOS3000/VOS2009 2.1.2.0 SQL Injection via login.jsp
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the login form and retrieve injected query results from a subsequent session request, enabling extraction of plaintext credentials and other database content with DBA-level privileges.
| CWE | CWE-89 |
| Vendor | kunshi network technology co., ltd. |
| Product | linknat vos3000 |
| Published | Jul 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for kunshi network technology co., ltd. linknat vos3000
Be the first to know when new critical vulnerabilities affecting kunshi network technology co., ltd. linknat vos3000 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Kunshi Network Technology Co., Ltd. / Linknat VOS3000
2.1.1.5 2.1.1.8 2.1.2.0
Kunshi Network Technology Co., Ltd. / Linknat VOS2009
2.1.1.5 2.1.1.8 2.1.2.0
References
web.archive.org: https://web.archive.org/web/20160601102456/http://www.wooyun.org/bugs/wooyun-2010-0145458 packetstorm.news: https://packetstorm.news/files/id/137159 linknat.com: https://www.linknat.com/ vulncheck.com: https://www.vulncheck.com/advisories/linknat-vos3000-vos2009-sql-injection-via-login-jsp
Credits
Osama Khalid 🔍 Fatullayev Asadbek