252 matches found
PT-2017-12117
Name of the Vulnerable Software and Affected Versions FineCms version 5.0.9 Description The issue concerns a SQL Injection flaw. It can be exploited via the num parameter in requests to "libraries/Template.php" with either "action=related" or "action=tags". Recommendations For FineCms version...
PT-2017-12119
Name of the Vulnerable Software and Affected Versions FineCms version 5.0.9 Description The issue concerns a SQL Injection flaw. It can be exploited via the field parameter in requests to "libraries/Template.php" with specific actions such as "module", "member", "form", or "related"...
PT-2017-12120
Name of the Vulnerable Software and Affected Versions FineCms version 5.0.9 Description The issue concerns remote PHP code execution via the param parameter in an "action=cache" request to "libraries/Template.php", which is an example of Eval Injection. Recommendations For FineCms version 5.0.9,...
CVE-2017-11584
dayrui FineCms 5.0.9 is affected by an SQL Injection in the field parameter used in actions=module, action=member, action=form, or action=related, targeting libraries/Template.php. The vulnerability is described across multiple sources (NVD/CNVD/PRION/CVE lists) with no explicit public fix/versio...
CVE-2017-11583
dayrui FineCms 5.0.9 has SQL Injection via the catid parameter in an action=related request to libraries/Template.php...
PT-2017-12118
Name of the Vulnerable Software and Affected Versions FineCms version 5.0.9 Description The issue is related to SQL Injection, which can be exploited via the catid parameter in an "action=related" request to the "libraries/Template.php" endpoint. Recommendations For FineCms version 5.0.9, avoid...
Arbitrary Code Execution
twig is vulnerable to arbitrary code execution. Attackers can execute code by leveraging a flaw in the displayBlock function in Template.php through the self variable. This can only be exploited when Sandbox mode is enabled...
FineCMS multi vulnerablity
Reflected XSS in getimage.php Technical Description: file /application/lib/ajax/getimage.php the $POST'id' and $POST'name' and $GET'folder' without any validated, sanitised or output encoded. Proof of ConceptPoC http://yourfinecms/application/lib/ajax/getimage.php?folder=1 POST: id=1"alert1&name=...
CVE-2017-10968: Improper Control of Generation of Code
In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "...
PT-2017-11645
Name of the Vulnerable Software and Affected Versions FineCMS through 2017-07-07 Description The issue allows remote PHP code execution. This can be achieved by placing the code after "?php" in a route=template request, specifically in the application/core/controller/template.php file...
CVE-2016-5834
Cross-site scripting XSS vulnerability in the wpgetattachmentlink function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833...
CVE-2016-5834
Cross-site scripting XSS vulnerability in the wpgetattachmentlink function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833...
CVE-2016-5834
CVE-2016-5834 corresponds to a cross-site scripting (XSS) vulnerability in WordPress where the wp_get_attachment_link function in wp-includes/post-template.php could be exploited by a crafted attachment name to inject arbitrary script or HTML. Affected product: WordPress prior to version 4.5.3. R...
CVE-2016-5834: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the wpgetattachmentlink function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833...
CVE-2015-7809
The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the self variable in a template...
Code injection
The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the self variable in a template...
CVE-2015-7809
The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the self variable in a template...
CVE-2015-7809
The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the self variable in a template...
