CVE-2017-13697

controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable...

CVE-2017-13697

CVE-2017-13697 affects Dayrui FineCMS 5.0.11 via an XSS flaw in controllers/member/api.php related to the dirname variable. The vulnerability allows injection of arbitrary scripts/HTML in contexts that reflect the input, enabling potential user‑level execution or social engineering. Exploitation ...