332 matches found
FineCMS Stored Cross-Site Scripting Vulnerability
FineCMS is an efficient and simple small and medium-sized content management system based on PHP+MySql+CI framework development for multiple terminals, including Pc-side web pages and mobile web pages, support for customized content models and member models, and can be customized fields, can be...
CVE-2017-11178
CVE-2017-11178 affects FineCMS up to 2017-07-11. The vulnerability is in application/core/controller/style.php where route=style accepts contents and filename parameters, enabling remote attackers to write to arbitrary files. Because file extensions are not checked, a PHP file could be overwritte...
File Upload Vulnerability for Registered Members of Poscms and finecms
POSCMS is an open source, cross-platform web content management system developed by Php+Mysql; FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. Poscms and finecms registered members of a file upload vulnerability , attackers can use the...
CVE-2017-10968
In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "?php" in a route=template request...
Cross site request forgery (csrf)
In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "?php" in a route=template request...
CVE-2017-10968
CVE-2017-10968 affects FineCMS versions up to 2017-07-07. The issue occurs in application/core/controller/template.php , where an attacker can achieve remote PHP code execution by placing code after the opening tag "
CVE-2017-10968
In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "?php" in a route=template request...
FineCMS Server-Side Request Forgery Vulnerability
FineCMS is a content management system based on PHP+MySql+CI framework. A server-side request forgery vulnerability exists in the application/lib/ajax/getimagedata.php file in versions of FineCMS prior to 2017-07-06. An attacker can exploit this vulnerability to perform unauthorized operations...
Design/Logic Flaw
In FineCMS before 2017-07-06, application\core\controller\config.php allows XSS in the 1 keyname, 2 keyvalue, and 3 meaning parameters...
Server side request forgery (ssrf)
In FineCMS before 2017-07-06, application/lib/ajax/getimagedata.php has SSRF, related to requests for non-image files with a modified HTTP Host header...
CVE-2017-10967
In FineCMS before 2017-07-06, application\core\controller\config.php allows XSS in the 1 keyname, 2 keyvalue, and 3 meaning parameters...
CVE-2017-10973
In FineCMS before 2017-07-06, application/lib/ajax/getimagedata.php has SSRF, related to requests for non-image files with a modified HTTP Host header...
CVE-2017-10973
In FineCMS before 2017-07-06, application/lib/ajax/getimagedata.php has SSRF, related to requests for non-image files with a modified HTTP Host header...
CVE-2017-10967
Affected software: FineCMS (before 2017-07-06). Vulnerable component: application/core/controller/config.php. Vulnerability type: Cross-site scripting (XSS). Affected parameters: key_name, key_value, and meaning. Root cause / details: The available descriptions indicate that FineCMS allows XSS vi...
CVE-2017-10967
In FineCMS before 2017-07-06, application\core\controller\config.php allows XSS in the 1 keyname, 2 keyvalue, and 3 meaning parameters...
CVE-2017-10973
In FineCMS before 2017-07-06, application/lib/ajax/getimagedata.php has SSRF, related to requests for non-image files with a modified HTTP Host header...
CVE-2017-10973
FineCMS before 2017-07-06 is affected by a server-side request forgery (SSRF) in application/lib/ajax/get_image_data.php, related to processing requests for non-image files with a modified HTTP Host header. Root cause appears to be improper handling of user-controlled Host header leading to unint...
Code Execution Vulnerability in FineCMS v5.0.8 Public Interest Edition Backend
FineCMS v5.0.8 is a cms for small and medium-sized websites developed by SkyRay programming team. FineCMS v5.0.8 public welfare version of the background there is a code execution vulnerability, remote attackers can take advantage of the vulnerability to insert code, and the code can be parsed...
Cross-site Scripting Vulnerability in FineCMS
FineCMS is a content management system based on PHP+MySql development A cross-site scripting vulnerability exists in the frontend message board of FineCMS version 5.0.8, due to the program failing to filter user-submitted data. An attacker can exploit this vulnerability to inject arbitrary Web...
