183 matches found
CVE-2018-18545
Fiyo CMS 2.0.7 has XSS via the dapur\apps\appuser\edituser.php name parameter...
CVE-2018-18545
The collected records confirm CVE-2018-18545 affects Fiyo CMS 2.0.7, with a Cross‑Site Scripting (XSS) vulnerability exposed via the name parameter in the file path dapur/apps/app_user/edit_user.php. The issue is documented as an XSS path in multiple sources (e.g., NVD and CNVD/CVE mirrors) and i...
FiyoCMS save_file.php file has an arbitrary file upload vulnerability
FiyoCMS is a content management system CMS for creating CMS templates. An arbitrary file upload vulnerability exists in the FiyoCMS savefile.php file. An attacker can exploit this vulnerability to upload malicious files and gain server privileges...
Fiyo CMS Arbitrary File Read Vulnerability
Fiyo CMS is a content management system CMS for creating CMS templates. An arbitrary file read vulnerability exists in the dapur/apps/apptheme/libs/checkfile.php file in Fiyo CMS version 2.0.7. An attacker can exploit this vulnerability to obtain sensitive information...
Fiyo CMS SQL Injection Vulnerability (CNVD-2018-00248)
Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the /apps/appuser/sysuser.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit this vulnerability to elevate user privileges to administrator privileges...
CVE-2017-17102
Fiyo CMS 2.0.7 has SQL injection in /system/site.php via $REQUEST'link'...
CVE-2017-17104
Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/apptheme/libs/checkfile.php via $GET'src' or $GET'name'...
CVE-2017-17102
Fiyo CMS 2.0.7 has SQL injection in /system/site.php via $REQUEST'link'...
CVE-2017-17103
Fiyo CMS 2.0.7 has SQL injection in /apps/appuser/sysuser.php via $POSTname or $POSTemail. This vulnerability can lead to escalation from normal user privileges to administrator privileges...
Arbitrary file deletion
Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/apptheme/libs/checkfile.php via $GET'src' or $GET'name'...
Sql injection
Fiyo CMS 2.0.7 has SQL injection in /system/site.php via $REQUEST'link'...
CVE-2017-17103
Fiyo CMS 2.0.7 has SQL injection in /apps/appuser/sysuser.php via $POSTname or $POSTemail. This vulnerability can lead to escalation from normal user privileges to administrator privileges...
Sql injection
Fiyo CMS 2.0.7 has SQL injection in /apps/appuser/sysuser.php via $POSTname or $POSTemail. This vulnerability can lead to escalation from normal user privileges to administrator privileges...
CVE-2017-17104
Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/apptheme/libs/checkfile.php via $GET'src' or $GET'name'...
CVE-2017-17102
CVE-2017-17102 is confirmed in connected sources as a SQL injection affecting Fiyo CMS 2.0.7, exploitable via /system/site.php using $_REQUEST['link']. The vulnerability allows a remote attacker to retrieve data from the database. No exploitation details are provided beyond that, and there is no ...
CVE-2017-17102
Fiyo CMS 2.0.7 has SQL injection in /system/site.php via $REQUEST'link'...
CVE-2017-17103
CVE-2017-17103 affects Fiyo CMS 2.0.7 with an SQL injection in the file /apps/app_user/sys_user.php via POST parameters name or email, enabling escalation from a normal user to administrator privileges. This vulnerability is documented across multiple sources (NVD/NVD-derived entries and CNVD-201...
CVE-2017-17104
Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/app_theme/libs/check_file.php exploitable via $_GET['src'] or $_GET['name']. The CVE-2017-17104 entry (CVSSv3 base 7.5 HIGH) confirms impact but the connected documents do not provide exploitation details or a remediation patch...