CVE-2017-11629

dayrui FineCms through 5.0.10 has Cross Site Scripting XSS in controllers/api.php via the function parameter in a c=api&m=data2 request...

CVE-2017-11583

dayrui FineCms 5.0.9 has SQL Injection via the catid parameter in an action=related request to libraries/Template.php...

CVE-2017-11585

dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libraries/Template.php, aka Eval Injection...

Design/Logic Flaw

dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libraries/Template.php, aka Eval Injection...

Sql injection

dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to libraries/Template.php...

CVE-2017-11584

dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.php...

CVE-2017-11581

CVE-2017-11581 affects dayrui FineCms 5.0.9 and is caused by a Cross Site Scripting (XSS) vulnerability in admin/Login.php, triggered by a username payload that does not begin with a '

CVE-2017-11584

dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.php...

CVE-2017-11583

FineCMS 5.0.9 has a SQL injection in libraries/Template.php via the catid parameter in an action=related request. Impact per CNVD/NVD records includes potential disclosure of all databases. No patch version or remediation is explicitly provided in the connected documents. Exploitation details are...

CVE-2017-11586

FineCMS 5.0.9 contains an open redirect vulnerability exploitable via the url parameter in a sync action, linked to controllers/Weixin.php. The NVD entry CVE-2017-11586 documents URL Redirector Abuse with CVSS 3.0 score 6.1 (NETWORK, PR:N, UI:R). Nuclei templates corroborate an open redirect cond...

CVE-2017-11585

CVE-2017-11585 affects dayrui FineCMS 5.0.9 with remote PHP code execution through the param parameter in an action=cache request to libraries/Template.php, described as Eval Injection. The vulnerability allows an attacker to inject and execute arbitrary PHP code on the server. Exploitation and e...

CVE-2017-11582

CVE-2017-11582 concerns dayrui FineCms 5.0.9, with a SQL Injection vulnerability in the libraries/Template.php file. The flaw is exploitable via the num parameter in requests for action=related or action=tags, enabling a remote attacker to execute arbitrary SQL commands. Multiple sources in the c...

CVE-2017-11582

dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to libraries/Template.php...

CVE-2017-11584

dayrui FineCms 5.0.9 is affected by an SQL Injection in the field parameter used in actions=module, action=member, action=form, or action=related, targeting libraries/Template.php. The vulnerability is described across multiple sources (NVD/CNVD/PRION/CVE lists) with no explicit public fix/versio...

CVE-2017-11586

dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php...

CVE-2017-11583

dayrui FineCms 5.0.9 has SQL Injection via the catid parameter in an action=related request to libraries/Template.php...

File upload vulnerability in finecms

FineCMS is a small and medium-sized content management system based on PHP+MySql+CI framework. File upload vulnerability exists in FineCMS. A file upload vulnerability exists in the newajaxupload function in \dayrui\controllers\member\Api.php, which can be exploited by an attacker to construct da...

Multiple File Upload and Arbitrary Code Execution Vulnerabilities in FineCMS

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. FineCMS has multiple file upload and arbitrary code execution vulnerabilities. finecms\dayrui\controllers\member\Api.php in the downfile and swfupload functions of the file upload vulnerability...

FineCMS多个SQL注射漏洞

简要描述： FineCMS多个SQL注射 详细说明： 注射文件存在于：/fang/目录下index.php文件 射点一：http://www.dayrui.net/fang/index.php 以官方演示站演示证明： http://www.dayrui.net/fang/index.php?c=search&area=2395&catid=1&order=updatetime' http://www.dayrui.net/fang/index.php?c=search&area=2395&zujin=0%2C500&catid=1'...