EUVD-2017-8090

Malware in sbrugna...

CVE-2017-16920

dayrui FineCms 5.2.0 is affected by CVE-2017-16920 due to a default SYS_KEY in v5/config/system.php that avoids key regeneration per installation. This allows remote attackers to upload arbitrary .php files through a member api swfupload action to index.php. The vulnerability description explicit...

CVE-2017-16920: Undefined Security Weakness

v5/config/system.php in dayrui FineCms 5.2.0 has a default SYSKEY value and does not require key regeneration for each installation, which allows remote attackers to upload arbitrary .php files via a member api swfupload action to index.php...