CVE-2017-11198

Cross-site scripting XSS vulnerability in /application/lib/ajax/getimage.php in FineCMS through 2017-07-12 allows remote attackers to inject arbitrary web script or HTML via the folder, id, or name parameter...

CVE-2017-11201

application/core/controller/images.php in FineCMS through 2017-07-12 allows remote authenticated admins to conduct XSS attacks by uploading an image via a route=images action...

CVE-2017-11202

FineCMS through 2017-07-12 allows XSS in visitors.php because JavaScript in visited URLs is not restricted either during logging or during the reading of logs, a different vulnerability than CVE-2017-11180...

Deserialization of untrusted data

application/core/controller/images.php in FineCMS through 2017-07-12 allows remote authenticated admins to conduct XSS attacks by uploading an image via a route=images action...

Design/Logic Flaw

FineCMS through 2017-07-12 allows XSS in visitors.php because JavaScript in visited URLs is not restricted either during logging or during the reading of logs, a different vulnerability than CVE-2017-11180...

Cross site scripting

Cross-site scripting XSS vulnerability in /application/lib/ajax/getimage.php in FineCMS through 2017-07-12 allows remote attackers to inject arbitrary web script or HTML via the folder, id, or name parameter...

Sql injection

SQL Injection exists in FineCMS through 2017-07-12 via the application/core/controller/excludes.php visitorip parameter...

CVE-2017-11202

CVE-2017-11202 refers to a FineCMS vulnerability up to 2017-07-12 where XSS is possible in visitors.php because JavaScript in visited URLs is not restricted during logging or when reading logs. This is described as a different vulnerability from CVE-2017-11180. Connected sources confirm broader X...

CVE-2017-11201

application/core/controller/images.php in FineCMS through 2017-07-12 allows remote authenticated admins to conduct XSS attacks by uploading an image via a route=images action...

CVE-2017-11200

SQL Injection exists in FineCMS through 2017-07-12 via the application/core/controller/excludes.php visitorip parameter...

CVE-2017-11202

FineCMS through 2017-07-12 allows XSS in visitors.php because JavaScript in visited URLs is not restricted either during logging or during the reading of logs, a different vulnerability than CVE-2017-11180...

CVE-2017-11201

The CVE-2017-11201 entry affects FineCMS, specifically the application/core/controller/images.php logic. The vulnerability allows XSS by uploading an image via route=images, exploited by remote authenticated admins. Affected versions are FineCMS up to 2017-07-12. The root cause is improper handli...

CVE-2017-11200

CVE-2017-11200 is a SQL injection vulnerability in FineCMS, present through 2017-07-12, exploitable via the visitor_ip parameter in application/core/controller/excludes.php. Public records (NVD and related CVE lists) indicate a high-severity impact (CVSS-3 base score 8.8) with network access, low...

CVE-2017-11198

CVE-2017-11198 is an XSS vulnerability in FineCMS, affecting the file /application/lib/ajax/get_image.php. The issue allows remote attackers to inject arbitrary web script or HTML by manipulating the folder, id, or name parameters in FineCMS releases up to 2017-07-12. Impact is described as cross...

FineCMS SQL Injection Vulnerability (CNVD-2017-15546)

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. An SQL injection vulnerability exists in FineCMS versions 2017-07-12 and earlier. The vulnerability can be exploited by an attacker to obtain data from the database with the help of the...

FineCMS Arbitrary Code Execution Vulnerability (CNVD-2017-15933)

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. An arbitrary code execution vulnerability exists in the applicationcorecontrollertemplate.php file in FineCMS 2017-07-07 and earlier versions. A remote attacker can exploit this vulnerability t...

FineCMS Arbitrary Code Execution Vulnerability

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. An arbitrary code execution vulnerability exists in FineCMS version 2.1.0. A remote attacker can exploit this vulnerability to execute arbitrary PHP code...

FineCMS Cross-Site Scripting Vulnerability (CNVD-2017-15547)

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. A cross-site scripting vulnerability exists in the application/core/controller/images.php file in FineCMS 2017-07-12 and earlier versions. A remote attacker can exploit this vulnerability to...

FineCMS Cross-Site Scripting Vulnerability (CNVD-2017-15545)

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. A cross-site scripting vulnerability exists in the /application/lib/ajax/getimage.php file in FineCMS 2017-07-12 and earlier versions. A remote attacker can exploit the vulnerability to inject...

FineCMS multi vulnerablity

Reflected XSS in getimage.php Technical Description: file /application/lib/ajax/getimage.php the $POST'id' and $POST'name' and $GET'folder' without any validated, sanitised or output encoded. Proof of ConceptPoC http://yourfinecms/application/lib/ajax/getimage.php?folder=1 POST: id=1"alert1&name=...