CVE-2016-20096 Linknat VOS3000/VOS2009 2.1.2.0 SQL Injection via login.jsp
Remote attackers can inject SQL via the login form to extract plaintext credentials and database content with DBA privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-20096?
CVE-2016-20096 is a critical SQL injection vulnerability in Kunshi Network Technology Co., Ltd. Linknat VOS2009, published on 21 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the login form and retrieve injected query results from a subsequent session request, enabling extraction of plaintext credentials and other database content with DBA-level privileges.
Weakness: CWE-89
Which versions are affected by CVE-2016-20096?
How do I fix CVE-2016-20096?
No fix has been published for CVE-2016-20096 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2016-20096 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-20096 exists.
Sources
Also known as GHSA-36f2-4m9x-c736.