CVE-2017-17104

Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/app_theme/libs/check_file.php exploitable via $_GET['src'] or $_GET['name']. The CVE-2017-17104 entry (CVSSv3 base 7.5 HIGH) confirms impact but the connected documents do not provide exploitation details or a remediation patch...

CVE-2017-17103

Fiyo CMS 2.0.7 has SQL injection in /apps/appuser/sysuser.php via $POSTname or $POSTemail. This vulnerability can lead to escalation from normal user privileges to administrator privileges...

CVE-2017-17104

Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/apptheme/libs/checkfile.php via $GET'src' or $GET'name'...

Sql injection

Multiple SQL injection vulnerabilities in Fiyo CMS 2.01.9.1 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to apps/apparticle/controller/rating.php or 2 user parameter to user/login...

CVE-2015-3934

Multiple SQL injection vulnerabilities in Fiyo CMS 2.01.9.1 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to apps/apparticle/controller/rating.php or 2 user parameter to user/login...

CVE-2015-3934

Fiyo CMS 2.0_1.9.1 is affected by SQL injection via two vectors: (1) id parameter in apps/app_article/controller/rating.php and (2) user parameter to user/login. Exploit details show the vulnerability arises from insufficient input sanitization in the rating.php flow and an injectable query on ar...

CVE-2015-3934

Multiple SQL injection vulnerabilities in Fiyo CMS 2.01.9.1 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to apps/apparticle/controller/rating.php or 2 user parameter to user/login...

Information disclosure

Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/...

Design/Logic Flaw

Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the 1 "Install and Update" or 2 Backup super administrator function via the view parameter in a direct request to fiyo/dapur...

CVE-2014-9147

Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/...

CVE-2014-9148

Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the 1 "Install and Update" or 2 Backup super administrator function via the view parameter in a direct request to fiyo/dapur...

CVE-2014-9147

CVE-2014-9147 affects Fiyo CMS 2.0.1.8. The vulnerability allows remote attackers to obtain sensitive information by directly requesting the database backup file in the ".backup/" path. The NVD entry records a high-severity vector (CVSSv3: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base score 7.5) with...

CVE-2014-9147

Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/...

CVE-2014-9148

CVE-2014-9148 concerns Fiyo CMS 2.0.1.8, where an attacker can bypass access restrictions by manipulating the view parameter in a direct request to fiyo/dapur, enabling remote execution of the Install and Update or Backup super administrator functions. The description specifies a direct parameter...

CVE-2014-9148

Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the 1 "Install and Update" or 2 Backup super administrator function via the view parameter in a direct request to fiyo/dapur...

Fiyo CMS Cross-Site Scripting Vulnerability (CNVD-2017-24320)

Fiyo CMS is a content management system CMS for creating CMS templates. A cross-site scripting vulnerability exists in the dapur\apps\appconfig\sysconfig.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of th...

CVE-2017-13778

Fiyo CMS 2.0.7 has XSS in dapur\apps\appconfig\sysconfig.php via the sitename parameter...

CVE-2017-13778

Fiyo CMS 2.0.7 has XSS in dapur\apps\appconfig\sysconfig.php via the sitename parameter...

Design/Logic Flaw

Fiyo CMS 2.0.7 has XSS in dapur\apps\appconfig\sysconfig.php via the sitename parameter...

CVE-2017-13778

Fiyo CMS 2.0.7 contains a Cross-Site Scripting (XSS) vulnerability in dapur/apps/app_config/sys_config.php via the site_name parameter. The root cause is improper sanitization of the site_name input, allowing arbitrary web script or HTML to be injected into pages served by the application. This a...