21 matches found
SUSE CVE-2017-11354
Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/apparticle/sysarticle.php via the name parameter in editing or adding a tag name...
CVE-2018-18545
Fiyo CMS 2.0.7 has XSS via the dapur\apps\appuser\edituser.php name parameter...
Fiyo CMS Arbitrary File Read Vulnerability
Fiyo CMS is a content management system CMS for creating CMS templates. An arbitrary file read vulnerability exists in the dapur/apps/apptheme/libs/checkfile.php file in Fiyo CMS version 2.0.7. An attacker can exploit this vulnerability to obtain sensitive information...
Arbitrary file deletion
Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/apptheme/libs/checkfile.php via $GET'src' or $GET'name'...
CVE-2017-17104
Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/apptheme/libs/checkfile.php via $GET'src' or $GET'name'...
CVE-2017-17104: Exposure of Sensitive Information to an Unauthorized Actor
Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/apptheme/libs/checkfile.php via $GET'src' or $GET'name'...
CVE-2014-9148: Improper Access Control
Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the 1 "Install and Update" or 2 Backup super administrator function via the view parameter in a direct request to fiyo/dapur...
CVE-2017-13778: Improper Neutralization of Input During Web Page Generation
Fiyo CMS 2.0.7 has XSS in dapur\apps\appconfig\sysconfig.php via the sitename parameter...
CVE-2017-11418
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/controller/articlelist.php via $GET'cat', $GET'user', $GET'level', and $GET'iSortCol'.$i...
CVE-2017-11415
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/sysarticle.php via $POST'parentid', $POST'desc', $POST'keys', and $POST'level'...
Fiyo CMS SQL Injection Vulnerability (CNVD-2017-23894)
Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the dapur/apps/apparticle/sysarticle.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit the vulnerability to execute arbitrary SQL commands with the help of...
CVE-2017-11415: Improper Neutralization of Special Elements used in an SQL Command
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/sysarticle.php via $POST'parentid', $POST'desc', $POST'keys', and $POST'level'...
CVE-2017-11413: Improper Neutralization of Special Elements used in an SQL Command
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/controller/commentstatus.php via $GET'id'...
CVE-2017-11354: Improper Neutralization of Special Elements used in an SQL Command
Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/apparticle/sysarticle.php via the name parameter in editing or adding a tag name...
Fiyo CMS Arbitrary File Upload Vulnerability
Fiyo CMS is a content management system CMS for creating CMS templates. A security vulnerability exists in Fiyo CMS versions 2.x through 2.0.7. The vulnerability can be exploited by an attacker to execute code by sending the 'content' parameter to the file /dapur/apps/apptheme/libs/savefile.php...
CVE-2017-6823
Fiyo CMS 2.0.6.1 allows remote authenticated users to gain privileges via a modified level parameter to dapur/ in an app=user&act=edit action...
CVE-2017-6823: Authentication Bypass by Capture-replay
Fiyo CMS 2.0.6.1 allows remote authenticated users to gain privileges via a modified level parameter to dapur/ in an app=user&act=edit action...
Fiyo-cms 2.018 /dapur/index.php SQL注入漏洞
漏洞链接： http://localhost/fiyo/dapur/index.php?app=user&act=edit&id=1sqli Parameter: id Type: UNION query Title: MySQL UNION query NULL - 10 columns Payload: app=user&act=edit&id=-1874 UNION ALL SELECT NULL,NULL,CONCAT0x7171676471,0x66457070464452786c58,0x716a767471,NULL,NULL,NULL,NULL,NULL,NULL,NUL...
CVE-2014-9146
Multiple cross-site scripting XSS vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to inject arbitrary web script or HTML via the 1 view, 2 id, 3 page, or 4 app parameter to the default URI or the 5 act parameter to dapur/index.php...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to inject arbitrary web script or HTML via the 1 view, 2 id, 3 page, or 4 app parameter to the default URI or the 5 act parameter to dapur/index.php...