8 matches found
CVE-2018-6893: Improper Neutralization of Special Elements used in an SQL Command
controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statement, lacks effective filtering...
PT-2018-17808
Name of the Vulnerable Software and Affected Versions FineCms version 5.2.0 Description The issue concerns SQL Injection in the FineCms software. Specifically, the "controllers/member/Api.php" file is affected when a request is made with certain parameters, including 's=member,c=api,m=checktitle'...
PT-2017-13294
Name of the Vulnerable Software and Affected Versions FineCms version 5.0.11 Description The issue is related to an XSS concern in the checktitle function, specifically in the module field within the controllers/member/api.php file. Recommendations For FineCms version 5.0.11, consider disabling t...
CVE-2017-14192: Improper Neutralization of Input During Web Page Generation
The checktitle function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the module field...
PT-2017-13295
Name of the Vulnerable Software and Affected Versions FineCms version 5.0.11 Description The issue is related to the oauth function in the controllers/member/api.php file, which has an XSS vulnerability concerning the Referer HTTP header, specifically with Internet Explorer. Recommendations For...
CVE-2017-14193: Improper Neutralization of Input During Web Page Generation
The oauth function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer...
PT-2017-13025
Name of the Vulnerable Software and Affected Versions FineCms version 5.0.11 Description The issue is related to XSS and concerns the dirname variable in the controllers/member/api.php file. Recommendations For FineCms version 5.0.11, consider restricting the use of the dirname variable in the...