SUSE CVE-2017-11354

Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/apparticle/sysarticle.php via the name parameter in editing or adding a tag name...

CVE-2018-18545

Fiyo CMS 2.0.7 has XSS via the dapur\apps\appuser\edituser.php name parameter...

Arbitrary file deletion

Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/apptheme/libs/checkfile.php via $GET'src' or $GET'name'...

CVE-2017-17104: Exposure of Sensitive Information to an Unauthorized Actor

Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/apptheme/libs/checkfile.php via $GET'src' or $GET'name'...

CVE-2017-13778: Improper Neutralization of Input During Web Page Generation

Fiyo CMS 2.0.7 has XSS in dapur\apps\appconfig\sysconfig.php via the sitename parameter...

CVE-2017-11418

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/controller/articlelist.php via $GET'cat', $GET'user', $GET'level', and $GET'iSortCol'.$i...

PT-2017-11994

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7 Description The issue concerns SQL injection. It can be exploited via the $ GET'id' variable in the dapur/apps/app comment/controller/comment status.php file. Recommendations For Fiyo CMS version 2.0.7, consider...

PT-2017-11999

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7 Description The issue concerns SQL injection. It can be exploited via the id variable in the /dapur/apps/app article/controller/article status.php endpoint. Recommendations For Fiyo CMS version 2.0.7, consider restrictin...

CVE-2017-11413: Improper Neutralization of Special Elements used in an SQL Command

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/controller/commentstatus.php via $GET'id'...

CVE-2017-11415: Improper Neutralization of Special Elements used in an SQL Command

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/sysarticle.php via $POST'parentid', $POST'desc', $POST'keys', and $POST'level'...

PT-2017-11954

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7 Description The issue is related to an SQL injection vulnerability. It occurs in the dapur/apps/app article/sys article.php file through the name parameter when editing or adding a tag name. Recommendations For Fiyo CMS...

CVE-2017-11354: Improper Neutralization of Special Elements used in an SQL Command

Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/apparticle/sysarticle.php via the name parameter in editing or adding a tag name...

PT-2017-18583

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7 Description The issue concerns an arbitrary file delete vulnerability. It is located in the dapur/apps/app config/controller/backuper.php file via directory traversal in the file parameter during an act=db action...

Fiyo CMS Arbitrary File Upload Vulnerability

Fiyo CMS is a content management system CMS for creating CMS templates. A security vulnerability exists in Fiyo CMS versions 2.x through 2.0.7. The vulnerability can be exploited by an attacker to execute code by sending the 'content' parameter to the file /dapur/apps/apptheme/libs/savefile.php...

PT-2017-17853

Name of the Vulnerable Software and Affected Versions Fiyo CMS versions 2.x through 2.0.7 Description The issue allows attackers to upload a webshell via the content parameter to the "/dapur/apps/app theme/libs/save file.php" API endpoint and then execute code. Recommendations For Fiyo CMS versio...

CVE-2014-9145: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in an edit action to dapur/index.php; 2 cat, 3 user, or 4 level parameter to dapur/apps/apparticle/controller/articlelist.php; or 5 email parameter in an emai...