CVE-2017-13697

controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable...

CVE-2017-13697

CVE-2017-13697 affects Dayrui FineCMS 5.0.11 via an XSS flaw in controllers/member/api.php related to the dirname variable. The vulnerability allows injection of arbitrary scripts/HTML in contexts that reflect the input, enabling potential user‑level execution or social engineering. Exploitation ...

finecms SQL injection vulnerability (CNVD-2017-28415)

FineCMS is a website building system based on PHP+MySql+CI framework. A SQL injection vulnerability exists in the controllersmemberContentController.php page in Finecms, which can be exploited by remote attackers to manipulate the website database...

CVE-2017-12774

finecms in 1.9.5\controllers\member\ContentController.php allows remote attackers to operate website database...

CVE-2017-12774

finecms in 1.9.5\controllers\member\ContentController.php allows remote attackers to operate website database...

CVE-2017-12774

finecms in 1.9.5\controllers\member\ContentController.php allows remote attackers to operate website database...

Code injection

finecms in 1.9.5\controllers\member\ContentController.php allows remote attackers to operate website database...

CVE-2017-12774

CVE-2017-12774 affects FineCMS 1.9.5, with a vulnerability in the file controllers/member/ContentController.php that allows remote attackers to manipulate the website database. Multiple connected sources describe an SQL injection risk in this controller, enabling unauthorized database operations....

CVE-2017-12774

finecms in 1.9.5\controllers\member\ContentController.php allows remote attackers to operate website database...

dayrui FineCms Cross-Site Scripting Vulnerability

dayrui FineCms is China Tianrui dayrui program design team released a set of content management system CMS using MVC architecture and PDO database interface development. A cross-site scripting vulnerability exists in the controllers/api.php file in dayrui FineCms 5.0.10 and earlier versions. A...

CVE-2017-11629

dayrui FineCms through 5.0.10 has Cross Site Scripting XSS in controllers/api.php via the function parameter in a c=api&m=data2 request...

Cross site scripting

dayrui FineCms through 5.0.10 has Cross Site Scripting XSS in controllers/api.php via the function parameter in a c=api&m=data2 request...

CVE-2017-11629

dayrui FineCms through 5.0.10 has Cross Site Scripting XSS in controllers/api.php via the function parameter in a c=api&m=data2 request...

CVE-2017-11629

FineCMS

CVE-2017-11629

dayrui FineCms through 5.0.10 has Cross Site Scripting XSS in controllers/api.php via the function parameter in a c=api&m=data2 request...

CVE-2017-11584

dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.php...

Design/Logic Flaw

dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libraries/Template.php, aka Eval Injection...

CVE-2017-11581

dayrui FineCms 5.0.9 has Cross Site Scripting XSS in admin/Login.php via a payload in the username field that does not begin with a '' character...

CVE-2017-11583

dayrui FineCms 5.0.9 has SQL Injection via the catid parameter in an action=related request to libraries/Template.php...

CVE-2017-11585

dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libraries/Template.php, aka Eval Injection...