332 matches found
CVE-2017-11178
In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. For example, this can be used to overwrite a .php file because the file extension is not checked...
CVE-2017-11180
CVE-2017-11180 affects FineCMS up to 2017-07-11; the issue is a stored XSS in the logging functionality. The payloads demonstrated involve (1) the User-Agent header of HTTP requests and (2) the username entered on the login screen. The root cause is that log processing allows XSS content to be st...
File Upload Vulnerability for Registered Members of Poscms and finecms
POSCMS is an open source, cross-platform web content management system developed by Php+Mysql; FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. Poscms and finecms registered members of a file upload vulnerability , attackers can use the...
Cross site request forgery (csrf)
In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "?php" in a route=template request...
CVE-2017-10968
In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "?php" in a route=template request...
CVE-2017-10968
CVE-2017-10968 affects FineCMS versions up to 2017-07-07. The issue occurs in application/core/controller/template.php , where an attacker can achieve remote PHP code execution by placing code after the opening tag "
CVE-2017-10968
In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "?php" in a route=template request...
FineCMS Server-Side Request Forgery Vulnerability
FineCMS is a content management system based on PHP+MySql+CI framework. A server-side request forgery vulnerability exists in the application/lib/ajax/getimagedata.php file in versions of FineCMS prior to 2017-07-06. An attacker can exploit this vulnerability to perform unauthorized operations...
Design/Logic Flaw
In FineCMS before 2017-07-06, application\core\controller\config.php allows XSS in the 1 keyname, 2 keyvalue, and 3 meaning parameters...
CVE-2017-10967
In FineCMS before 2017-07-06, application\core\controller\config.php allows XSS in the 1 keyname, 2 keyvalue, and 3 meaning parameters...
CVE-2017-10973
In FineCMS before 2017-07-06, application/lib/ajax/getimagedata.php has SSRF, related to requests for non-image files with a modified HTTP Host header...
CVE-2017-10973
In FineCMS before 2017-07-06, application/lib/ajax/getimagedata.php has SSRF, related to requests for non-image files with a modified HTTP Host header...
Server side request forgery (ssrf)
In FineCMS before 2017-07-06, application/lib/ajax/getimagedata.php has SSRF, related to requests for non-image files with a modified HTTP Host header...
CVE-2017-10973
In FineCMS before 2017-07-06, application/lib/ajax/getimagedata.php has SSRF, related to requests for non-image files with a modified HTTP Host header...
CVE-2017-10973
FineCMS before 2017-07-06 is affected by a server-side request forgery (SSRF) in application/lib/ajax/get_image_data.php, related to processing requests for non-image files with a modified HTTP Host header. Root cause appears to be improper handling of user-controlled Host header leading to unint...
CVE-2017-10967
In FineCMS before 2017-07-06, application\core\controller\config.php allows XSS in the 1 keyname, 2 keyvalue, and 3 meaning parameters...
CVE-2017-10967
Affected software: FineCMS (before 2017-07-06). Vulnerable component: application/core/controller/config.php. Vulnerability type: Cross-site scripting (XSS). Affected parameters: key_name, key_value, and meaning. Root cause / details: The available descriptions indicate that FineCMS allows XSS vi...
Code Execution Vulnerability in FineCMS v5.0.8 Public Interest Edition Backend
FineCMS v5.0.8 is a cms for small and medium-sized websites developed by SkyRay programming team. FineCMS v5.0.8 public welfare version of the background there is a code execution vulnerability, remote attackers can take advantage of the vulnerability to insert code, and the code can be parsed...
Cross-site Scripting Vulnerability in FineCMS
FineCMS is a content management system based on PHP+MySql development A cross-site scripting vulnerability exists in the frontend message board of FineCMS version 5.0.8, due to the program failing to filter user-submitted data. An attacker can exploit this vulnerability to inject arbitrary Web...
