119 matches found
CVE-2017-16920
dayrui FineCms 5.2.0 is affected by CVE-2017-16920 due to a default SYS_KEY in v5/config/system.php that avoids key regeneration per installation. This allows remote attackers to upload arbitrary .php files through a member api swfupload action to index.php. The vulnerability description explicit...
CVE-2017-16866
dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting XSS in core/MController.php via the DRURI field...
Cross site scripting
dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting XSS in core/MController.php via the DRURI field...
CVE-2017-16866
dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting XSS in core/MController.php via the DRURI field...
CVE-2017-16866
CVE-2017-16866 affects dayrui FineCms 5.2.0 prior to 2017-11-16. The vulnerability is a Cross-Site Scripting (XSS) in the code path core/M_Controller.php via the DR_URI field. The connected documents confirm the affected product/component and the root cause (injection in DR_URI leading to XSS). N...
dayrui FineCms 'call_msg' Function Cross-Site Scripting Vulnerability
dayrui FineCms is China Tianrui dayrui program design team released a set of content management system CMS using MVC architecture and PDO database interface development. A cross-site scripting vulnerability exists in the 'callmsg' function in the controllers/Form.php file in version 5.0.11 of...
dayrui FineCms 'oauth' function cross-site scripting vulnerability
dayrui FineCms is China Tianrui dayrui program design team released a set of content management system CMS using MVC architecture and PDO database interface development. A cross-site scripting vulnerability exists in the 'oauth' function of the controllers/member/api.php file in version 5.0.11 of...
dayrui FineCms 'out' function cross-site scripting vulnerability
dayrui FineCms is China Tianrui dayrui program design team released a set of content management system CMS using MVC architecture and PDO database interface development. A cross-site scripting vulnerability exists in the 'out' function of the controllers/member/Login.php file in version 5.0.11 of...
dayrui FineCms 'checktitle' Function Cross-Site Scripting Vulnerability
dayrui FineCms is China Tianrui dayrui program design team released a set of content management system CMS using MVC architecture and PDO database interface development. A cross-site scripting vulnerability exists in the 'checktitle' function in the controllers/member/api.php file in version 5.0....
CVE-2017-14195
The callmsg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to the Referer HTTP header with Internet Explorer...
CVE-2017-14195
The callmsg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to the Referer HTTP header with Internet Explorer...
CVE-2017-14194
The CVE-2017-14194 entry concerns dayrui FineCms version 5.0.11, where the out function in controllers/member/Login.php is reported to have an XSS vulnerability related to the Referer HTTP header in Internet Explorer. Multiple connected records (NVD, Red Hat, CNVD, CVE list mirrors, and regional ...
Cross site scripting
controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable...
CVE-2017-13697
controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable...
CVE-2017-13697
controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable...
CVE-2017-13697
CVE-2017-13697 affects Dayrui FineCMS 5.0.11 via an XSS flaw in controllers/member/api.php related to the dirname variable. The vulnerability allows injection of arbitrary scripts/HTML in contexts that reflect the input, enabling potential user‑level execution or social engineering. Exploitation ...
dayrui FineCms Cross-Site Scripting Vulnerability
dayrui FineCms is China Tianrui dayrui program design team released a set of content management system CMS using MVC architecture and PDO database interface development. A cross-site scripting vulnerability exists in the controllers/api.php file in dayrui FineCms 5.0.10 and earlier versions. A...
Cross site scripting
dayrui FineCms through 5.0.10 has Cross Site Scripting XSS in controllers/api.php via the function parameter in a c=api&m=data2 request...