Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Kunshi Network Technology Co., Ltd. Linknat VOS3000 — Linknat VOS3000/VOS2009 2.1.2.0 SQL Injection via login.jsp
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N L N N N H H H 9.3 .0038 31.5 —
AFFECTED
Product Versions Fixed
Linknat VOS3000 2.1.1.5 – —
Linknat VOS2009 2.1.1.5 – —
TIMELINE
Jul 21 Reserved by VulnCheck
Jul 21 Published (CNA: VulnCheck)
Jul 22 EXPLOIT PUBLISHED — CVE-2016-20096 (Kunshi Network Technology Co., Ltd. Linknat VOS3000). Public exploit reference added.
Description
Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the login form and retrieve injected query results from a subsequent session request, enabling extraction of plaintext credentials and other database content with DBA-level privileges.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| July 21, 2026 | Reserved | Reserved by VulnCheck |
| July 21, 2026 | Published | Published (CNA: VulnCheck) |
| July 22, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2016-20096 (Kunshi Network Technology Co., Ltd. Linknat VOS3000). Public exploit reference added. |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2016-20096 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.