CVE-2017-11581

dayrui FineCms 5.0.9 has Cross Site Scripting XSS in admin/Login.php via a payload in the username field that does not begin with a '' character...

CVE-2017-11583

dayrui FineCms 5.0.9 has SQL Injection via the catid parameter in an action=related request to libraries/Template.php...

CVE-2017-11582

dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to libraries/Template.php...

CVE-2017-11584

dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.php...

Sql injection

dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to libraries/Template.php...

Cross site scripting

dayrui FineCms 5.0.9 has Cross Site Scripting XSS in admin/Login.php via a payload in the username field that does not begin with a '' character...

CVE-2017-11586

dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php...

Sql injection

dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.php...

CVE-2017-11584

dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.php...

CVE-2017-11581

dayrui FineCms 5.0.9 has Cross Site Scripting XSS in admin/Login.php via a payload in the username field that does not begin with a '' character...

CVE-2017-11582

dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to libraries/Template.php...

Code injection

dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php...

Finecms foreground catid parameter has SQL injection vulnerability

FineCMS is an efficient and simple small and medium-sized content management system based on PHP+MySql+CI framework. An SQL injection vulnerability exists in the frontend catid parameter of finecms. An attacker can exploit this vulnerability to obtain database information...

FineCms SQL Injection Vulnerability (CNVD-2017-18532)

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. A SQL injection vulnerability exists in FineCms version 5.0.9. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands...

SQL Injection Vulnerability in finecms Frontend num Parameter

FineCMS is an efficient and simple small and medium-sized content management system based on PHP+MySql+CI framework. A SQL injection vulnerability exists in the frontend num parameter of finecms. An attacker can exploit this vulnerability to obtain database information...

CVE-2017-11585

dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libraries/Template.php, aka Eval Injection...

FineCms Open Redirect Vulnerability

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. An open redirection vulnerability exists in FineCms version 5.0.9. An attacker can exploit this vulnerability to redirect users to an arbitrary URL...

SQL Injection Vulnerability in finecms Frontend Field Parameters

FineCMS is an efficient and simple small and medium-sized content management system based on PHP+MySql+CI framework. A SQL injection vulnerability exists in the frontend field parameter of finecms. An attacker can exploit this vulnerability to obtain database information...

CVE-2017-11581

dayrui FineCms 5.0.9 has Cross Site Scripting XSS in admin/Login.php via a payload in the username field that does not begin with a '' character...

FineCms SQL Injection Vulnerability (CNVD-2017-18530)

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. A SQL injection vulnerability exists in FineCms version 5.0.9. A remote attacker can inject arbitrary SQL commands with the help of the 'field' parameter in an action=module, action=member,...