365 matches found
CVE-2017-11178
CVE-2017-11178 affects FineCMS up to 2017-07-11. The vulnerability is in application/core/controller/style.php where route=style accepts contents and filename parameters, enabling remote attackers to write to arbitrary files. Because file extensions are not checked, a PHP file could be overwritte...
CVE-2017-11179
CVE-2017-11179 affects FineCMS up to 2017-07-11. The vulnerability is a stored XSS in two routes: route=admin (modifying user information) and route=register (registering a user account). The documents do not provide root-cause specifics beyond the XSS description, nor do they include remediation...
CVE-2017-11179
FineCMS through 2017-07-11 has stored XSS in route=admin when modifying user information, and in route=register when registering a user account...
CVE-2017-11180: Improper Neutralization of Input During Web Page Generation
FineCMS through 2017-07-11 has stored XSS in the logging functionality, as demonstrated by an XSS payload in 1 the User-Agent header of an HTTP request or 2 the username entered on the login screen...
CVE-2017-11178: Insufficient Verification of Data Authenticity
In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. For example, this can be used to overwrite a .php file because the file extension is not checked...
FineCMS Arbitrary File Write Vulnerability
FineCMS is an efficient and simple small and medium-sized content management system based on PHP+MySql+CI framework development for multiple terminals, including Pc-side web pages and mobile web pages, support for customized content models and member models, and can be customized fields, can be...
CVE-2017-11167: Improper Control of Generation of Code
FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', sequence in a domain name, as demonstrated by the ',phpinfo input value...
CVE-2017-11180
CVE-2017-11180 affects FineCMS up to 2017-07-11; the issue is a stored XSS in the logging functionality. The payloads demonstrated involve (1) the User-Agent header of HTTP requests and (2) the username entered on the login screen. The root cause is that log processing allows XSS content to be st...
CVE-2017-11178
In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. For example, this can be used to overwrite a .php file because the file extension is not checked...
File Upload Vulnerability for Registered Members of Poscms and finecms
POSCMS is an open source, cross-platform web content management system developed by Php+Mysql; FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. Poscms and finecms registered members of a file upload vulnerability , attackers can use the...
Cross site request forgery (csrf)
In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "?php" in a route=template request...
CVE-2017-10968
In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "?php" in a route=template request...
CVE-2017-10968
CVE-2017-10968 affects FineCMS versions up to 2017-07-07. The issue occurs in application/core/controller/template.php , where an attacker can achieve remote PHP code execution by placing code after the opening tag "
CVE-2017-10968
In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "?php" in a route=template request...
CVE-2017-10968: Improper Control of Generation of Code
In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "...
FineCMS Server-Side Request Forgery Vulnerability
FineCMS is a content management system based on PHP+MySql+CI framework. A server-side request forgery vulnerability exists in the application/lib/ajax/getimagedata.php file in versions of FineCMS prior to 2017-07-06. An attacker can exploit this vulnerability to perform unauthorized operations...
Design/Logic Flaw
In FineCMS before 2017-07-06, application\core\controller\config.php allows XSS in the 1 keyname, 2 keyvalue, and 3 meaning parameters...
CVE-2017-10967
In FineCMS before 2017-07-06, application\core\controller\config.php allows XSS in the 1 keyname, 2 keyvalue, and 3 meaning parameters...
