FineCMS Cross-Site Scripting Vulnerability (CNVD-2017-15545)

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. A cross-site scripting vulnerability exists in the /application/lib/ajax/getimage.php file in FineCMS 2017-07-12 and earlier versions. A remote attacker can exploit the vulnerability to inject...

FineCMS Arbitrary Code Execution Vulnerability (CNVD-2017-15933)

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. An arbitrary code execution vulnerability exists in the applicationcorecontrollertemplate.php file in FineCMS 2017-07-07 and earlier versions. A remote attacker can exploit this vulnerability t...

CVE-2017-11200: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in FineCMS through 2017-07-12 via the application/core/controller/excludes.php visitorip parameter...

FineCMS Arbitrary Code Execution Vulnerability

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. An arbitrary code execution vulnerability exists in FineCMS version 2.1.0. A remote attacker can exploit this vulnerability to execute arbitrary PHP code...

CVE-2017-11167

FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', sequence in a domain name, as demonstrated by the ',phpinfo input value...

CVE-2017-11167

FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', sequence in a domain name, as demonstrated by the ',phpinfo input value...

Code injection

FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', sequence in a domain name, as demonstrated by the ',phpinfo input value...

CVE-2017-11167

CVE-2017-11167 affects FineCMS 2.1.0. The vulnerability allows remote attackers to execute arbitrary PHP code by abusing the URL Manager’s “Add Site” action: entering code after a ', sequence in a domain name, demonstrated with ',phpinfo()'. Connected CNVD/CNVD-2017-15550 and NVD entries corrobor...

CVE-2017-11167

FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', sequence in a domain name, as demonstrated by the ',phpinfo input value...

CVE-2017-11180

FineCMS through 2017-07-11 has stored XSS in the logging functionality, as demonstrated by an XSS payload in 1 the User-Agent header of an HTTP request or 2 the username entered on the login screen...

Cross site scripting

FineCMS through 2017-07-11 has stored XSS in the logging functionality, as demonstrated by an XSS payload in 1 the User-Agent header of an HTTP request or 2 the username entered on the login screen...

CVE-2017-11178

In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. For example, this can be used to overwrite a .php file because the file extension is not checked...

CVE-2017-11179

FineCMS through 2017-07-11 has stored XSS in route=admin when modifying user information, and in route=register when registering a user account...

CVE-2017-11178

In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. For example, this can be used to overwrite a .php file because the file extension is not checked...

Cross site scripting

FineCMS through 2017-07-11 has stored XSS in route=admin when modifying user information, and in route=register when registering a user account...

Design/Logic Flaw

In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. For example, this can be used to overwrite a .php file because the file extension is not checked...

CVE-2017-11180

FineCMS through 2017-07-11 has stored XSS in the logging functionality, as demonstrated by an XSS payload in 1 the User-Agent header of an HTTP request or 2 the username entered on the login screen...

FineCMS Stored Cross-Site Scripting Vulnerability

FineCMS is an efficient and simple small and medium-sized content management system based on PHP+MySql+CI framework development for multiple terminals, including Pc-side web pages and mobile web pages, support for customized content models and member models, and can be customized fields, can be...

FineCMS stored cross-site scripting vulnerability (CNVD-2017-15721)

FineCMS is an efficient and simple small and medium-sized content management system based on PHP+MySql+CI framework development for multiple terminals, including Pc-side web pages and mobile web pages, support for customized content models and member models, and can be customized fields, can be...

CVE-2017-11179: Improper Neutralization of Input During Web Page Generation

FineCMS through 2017-07-11 has stored XSS in route=admin when modifying user information, and in route=register when registering a user account...