183 matches found
Sql injection
Multiple SQL injection vulnerabilities in Fiyo CMS 2.01.9.1 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to apps/apparticle/controller/rating.php or 2 user parameter to user/login...
CVE-2015-3934
Multiple SQL injection vulnerabilities in Fiyo CMS 2.01.9.1 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to apps/apparticle/controller/rating.php or 2 user parameter to user/login...
CVE-2015-3934
Fiyo CMS 2.0_1.9.1 is affected by SQL injection via two vectors: (1) id parameter in apps/app_article/controller/rating.php and (2) user parameter to user/login. Exploit details show the vulnerability arises from insufficient input sanitization in the rating.php flow and an injectable query on ar...
CVE-2015-3934
Multiple SQL injection vulnerabilities in Fiyo CMS 2.01.9.1 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to apps/apparticle/controller/rating.php or 2 user parameter to user/login...
CVE-2014-9147
Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/...
CVE-2014-9148
Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the 1 "Install and Update" or 2 Backup super administrator function via the view parameter in a direct request to fiyo/dapur...
Information disclosure
Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/...
Design/Logic Flaw
Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the 1 "Install and Update" or 2 Backup super administrator function via the view parameter in a direct request to fiyo/dapur...
CVE-2014-9147
CVE-2014-9147 affects Fiyo CMS 2.0.1.8. The vulnerability allows remote attackers to obtain sensitive information by directly requesting the database backup file in the ".backup/" path. The NVD entry records a high-severity vector (CVSSv3: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base score 7.5) with...
CVE-2014-9147
Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/...
CVE-2014-9148
CVE-2014-9148 concerns Fiyo CMS 2.0.1.8, where an attacker can bypass access restrictions by manipulating the view parameter in a direct request to fiyo/dapur, enabling remote execution of the Install and Update or Backup super administrator functions. The description specifies a direct parameter...
CVE-2014-9148
Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the 1 "Install and Update" or 2 Backup super administrator function via the view parameter in a direct request to fiyo/dapur...
Fiyo CMS Cross-Site Scripting Vulnerability (CNVD-2017-24320)
Fiyo CMS is a content management system CMS for creating CMS templates. A cross-site scripting vulnerability exists in the dapur\apps\appconfig\sysconfig.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of th...
CVE-2017-13778
Fiyo CMS 2.0.7 has XSS in dapur\apps\appconfig\sysconfig.php via the sitename parameter...
Design/Logic Flaw
Fiyo CMS 2.0.7 has XSS in dapur\apps\appconfig\sysconfig.php via the sitename parameter...
CVE-2017-13778
Fiyo CMS 2.0.7 contains a Cross-Site Scripting (XSS) vulnerability in dapur/apps/app_config/sys_config.php via the site_name parameter. The root cause is improper sanitization of the site_name input, allowing arbitrary web script or HTML to be injected into pages served by the application. This a...
CVE-2017-13778
Fiyo CMS 2.0.7 has XSS in dapur\apps\appconfig\sysconfig.php via the sitename parameter...
Fiyo CMS Arbitrary File Deletion Vulnerability (CNVD-2017-26594)
Fiyo CMS is a content management system CMS for creating CMS templates. A security vulnerability exists in the dapur\apps\appconfig\controller\backuper.php file in Fiyo CMS version 2.0.7. The vulnerability can be exploited by a remote attacker to delete arbitrary files using the 'file' parameter ...
Fiyo CMS dapur/app/app_user/controller/status.php file SQL injection vulnerability
Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the dapur/app/appuser/controller/status.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit this vulnerability with the help of the 'id' parameter to cause a delayed...