197 matches found
CVE-2017-13778
Fiyo CMS 2.0.7 has XSS in dapur\apps\appconfig\sysconfig.php via the sitename parameter...
Fiyo CMS Arbitrary File Deletion Vulnerability (CNVD-2017-26594)
Fiyo CMS is a content management system CMS for creating CMS templates. A security vulnerability exists in the dapur\apps\appconfig\controller\backuper.php file in Fiyo CMS version 2.0.7. The vulnerability can be exploited by a remote attacker to delete arbitrary files using the 'file' parameter ...
Fiyo CMS dapur/app/app_user/controller/status.php file SQL injection vulnerability
Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the dapur/app/appuser/controller/status.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit this vulnerability with the help of the 'id' parameter to cause a delayed...
CVE-2017-11630
dapur\apps\appconfig\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request, a different vulnerability than CVE-2017-8853...
CVE-2017-11631
dapur/app/appuser/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter...
Directory traversal
dapur\apps\appconfig\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request, a different vulnerability than CVE-2017-8853...
CVE-2017-11631
dapur/app/appuser/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter...
Sql injection
dapur/app/appuser/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter...
CVE-2017-11630
Summary (CVE-2017-11630) Fiyo CMS 2.0.7 is affected by an arbitrary file deletion vulnerability in the file parameter of the type=database request, triggered via directory traversal in dapur\apps\app_config\controller\backuper.php. The issue allows remote attackers to delete arbitrary files. The ...
CVE-2017-11631
CVE-2017-11631 affects Fiyo CMS 2.0.7: the file dapur/app/app_user/controller/status.php exposes an SQL injection vulnerability via the id parameter. The vulnerability arises from unsafely interpolating the id value into a SQL query, potentially allowing an attacker to perform arbitrary queries. ...
CVE-2017-11631
dapur/app/appuser/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter...
CVE-2017-11630
dapur\apps\appconfig\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request, a different vulnerability than CVE-2017-8853...
Fiyo CMS dapur/apps/app_article/sys_article.php file SQL injection vulnerability
Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the dapur/apps/apparticle/sysarticle.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands...
Sql injection
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/appcomment/syscomment.php via $POST'comment', $POST'name', $POST'web', $POST'email', $POST'status', $POST'id', and $REQUEST'id'...
Sql injection
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/controller/commentstatus.php via $GET'id'...
CVE-2017-11418
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/controller/articlelist.php via $GET'cat', $GET'user', $GET'level', and $GET'iSortCol'.$i...
CVE-2017-11416
Fiyo CMS 2.0.7 has SQL injection in /apps/appcomment/controller/insert.php via the name parameter...
CVE-2017-11419
Fiyo CMS 2.0.7 has SQL injection in /apps/apparticle/controller/editor.php via $POST'id' and $POST'arttitle'...