EUVD-2017-5705

Malware in sbrugna...

EUVD-2017-3199

Malware in sbrugna...

EUVD-2017-3198

Malware in sbrugna...

CVE-2017-14192

The checktitle function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the module field...

CVE-2018-18191

Cross-site request forgery CSRF vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password...

CVE-2018-18191

CVE-2018-18191 describes a Cross‑Site Request Forgery (CSRF) vulnerability in Dayrui FineCms 5.4, specifically in /admin.php?c=member&m=edit&uid=1, which allows remote attackers to change the administrator’s password. The connected documents confirm the affected product/version and the vulnerable...

CVE-2018-7476

CVE-2018-7476 affects FineCms 5.3.0. A Cross Site Scripting (XSS) flaw exists in controllers/admin/Linkage.php reachable via id or lid in a c=linkage,m=import request to admin.php, where the xss_clean protection is bypassed by crafted input that omits ''. The vulnerability is documented across NV...

CVE-2018-6893

controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statement, lacks effective filtering...

CVE-2018-6893

controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statement, lacks effective filtering...

Sql injection

controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statement, lacks effective filtering...

CVE-2018-6893

FineCms 5.2.0 is affected by an SQL injection in controllers/member/Api.php when handling requests with s=member,c=api,m=checktitle and a crafted module parameter, due to insufficient filtering. The issue enables arbitrary SQL execution via the vulnerable parameter, as reported in multiple source...

CVE-2018-6893

controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statement, lacks effective filtering...

CVE-2017-16920

v5/config/system.php in dayrui FineCms 5.2.0 has a default SYSKEY value and does not require key regeneration for each installation, which allows remote attackers to upload arbitrary .php files via a member api swfupload action to index.php...

CVE-2017-16920

dayrui FineCms 5.2.0 is affected by CVE-2017-16920 due to a default SYS_KEY in v5/config/system.php that avoids key regeneration per installation. This allows remote attackers to upload arbitrary .php files through a member api swfupload action to index.php. The vulnerability description explicit...

CVE-2017-16866

dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting XSS in core/MController.php via the DRURI field...

CVE-2017-16866

dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting XSS in core/MController.php via the DRURI field...

CVE-2017-16866

CVE-2017-16866 affects dayrui FineCms 5.2.0 prior to 2017-11-16. The vulnerability is a Cross-Site Scripting (XSS) in the code path core/M_Controller.php via the DR_URI field. The connected documents confirm the affected product/component and the root cause (injection in DR_URI leading to XSS). N...

dayrui FineCms 'call_msg' Function Cross-Site Scripting Vulnerability

dayrui FineCms is China Tianrui dayrui program design team released a set of content management system CMS using MVC architecture and PDO database interface development. A cross-site scripting vulnerability exists in the 'callmsg' function in the controllers/Form.php file in version 5.0.11 of...

dayrui FineCms 'out' function cross-site scripting vulnerability

dayrui FineCms is China Tianrui dayrui program design team released a set of content management system CMS using MVC architecture and PDO database interface development. A cross-site scripting vulnerability exists in the 'out' function of the controllers/member/Login.php file in version 5.0.11 of...

dayrui FineCms 'oauth' function cross-site scripting vulnerability

dayrui FineCms is China Tianrui dayrui program design team released a set of content management system CMS using MVC architecture and PDO database interface development. A cross-site scripting vulnerability exists in the 'oauth' function of the controllers/member/api.php file in version 5.0.11 of...