finecms 5.0.6 backend has arbitrary file read and CSRF vulnerabilities

FineCMS is a content management system based on PHP+MySql. FineCMS 5.x version of the foreground exists arbitrary file reading and CSRF vulnerability, an attacker can exploit the vulnerability by replacing... /The vulnerability can be exploited to read arbitrary configuration table files, execute...

Code Execution Vulnerability in FineCMS Frontend name and params Parameters

FineCMS is a content management system based on PHP+MySql. A code execution vulnerability exists in the name and params parameters in the frontend of FineCMS version 5.0.6, which allows remote attackers to execute arbitrary code without logging in...

Code Execution Vulnerability in FineCMS Frontend Mid Parameter

FineCMS is a content management system based on PHP+MySql. A code execution vulnerability exists in the frontend mid parameter of FineCMS version 5.0.6, which allows remote attackers to execute arbitrary code without logging in...

Multiple File Upload and Arbitrary Code Execution Vulnerabilities in FineCMS

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. FineCMS has multiple file upload and arbitrary code execution vulnerabilities. finecms\dayrui\controllers\member\Api.php in the downfile and swfupload functions of the file upload vulnerability...

FineCMS Cross-Site Scripting Vulnerability (CNVD-2017-10156)

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. A cross-site scripting vulnerability exists in the sitename parameter in the admin.php script of FineCMS 2017-05-28 and earlier versions. An attacker can exploit this vulnerability to inject...

FineCMS Cross-Site Scripting Vulnerability (CNVD-2017-10157)

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. A cross-site scripting vulnerability exists in the search page in FineCMS versions 2017-05-28 and earlier. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTM...

Cross site scripting

andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the sitename parameter to admin.php...

CVE-2017-9252

andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search parameter to index.php in a route=search action...

Cross site scripting

andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search parameter to index.php in a route=search action...

CVE-2017-9251

andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the sitename parameter to admin.php...

CVE-2017-9251

andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the sitename parameter to admin.php...

CVE-2017-9252

Vulnerability context: CVE-2017-9252 affects FineCMS up to 2017-05-28. It is a reflected Cross-Site Scripting (XSS) in the search page, exploitable via the text-search parameter to index.php with route=search. What’s affected: FineCMS’s search functionality (versions prior to or including 2017-05...

CVE-2017-9252

andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search parameter to index.php in a route=search action...

CVE-2017-9251

FineCMS prior to 2017-05-28 is vulnerable to a reflected XSS in the sitename parameter of admin.php. The vulnerability is confirmed across multiple sources; the root cause is unsanitized input reflected in the sitename field. Impact is XSS (arbitrary script/HTML execution) in affected pages. Expl...

PT-2017-18807 · Andrzuk · Finecms

Name of the Vulnerable Software and Affected Versions: andrzuk/FineCMS versions prior to 2017-05-28 Description: The issue is related to a reflected XSS in the sitename parameter to the "admin.php" endpoint. Recommendations: For versions prior to 2017-05-28, as a temporary workaround, consider...

PT-2017-18808 · Andrzuk · Finecms

Name of the Vulnerable Software and Affected Versions: andrzuk/FineCMS versions prior to 2017-05-28 Description: The issue is related to a reflected XSS in the search page. This occurs via the text-search parameter to "index.php" in a "route=search" action. Recommendations: For versions prior to...

Cross-site scripting vulnerability in FineCMS latest version 2.1.5

FineCMS is a content management system based on PHP+MySql. The latest version of FineCMS version 2.1.5 has a cross-site scripting vulnerability, the vulnerability stems from the front-end avatar uploads are not sufficiently filtered user-submitted inputs, an attacker can exploit the vulnerability...

Arbitrary code execution vulnerability in FineCms backend controllers\admin\MemberController.php page

FineCMS is a content management system developed using MVC architecture and PDO database interface. An arbitrary code execution vulnerability exists in the Finecms backend controllers\admin\ MemberController.php page. Because the submitted data is not effectively filtered, an attacker can exploit...

Arbitrary code execution vulnerability in Finecms backend controllers\admin\Sms.php page

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. An arbitrary code execution vulnerability exists in the Finecms backend controllers\admin\Sms.php page. Since the array2string function does not filter the submitted data, allowing attackers to...

Input validation

andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation of the action parameter in application/classes/application.php...