234 matches found
CVE-2014-9148
Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the 1 "Install and Update" or 2 Backup super administrator function via the view parameter in a direct request to fiyo/dapur...
CVE-2014-9147
Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/...
CVE-2014-9148
CVE-2014-9148 concerns Fiyo CMS 2.0.1.8, where an attacker can bypass access restrictions by manipulating the view parameter in a direct request to fiyo/dapur, enabling remote execution of the Install and Update or Backup super administrator functions. The description specifies a direct parameter...
PT-2017-6328
Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.1.8 Description The issue allows remote attackers to obtain sensitive information by making a direct request to the database backup file in .backup/. Recommendations For Fiyo CMS version 2.0.1.8, restrict access to the...
CVE-2014-9148: Improper Access Control
Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the 1 "Install and Update" or 2 Backup super administrator function via the view parameter in a direct request to fiyo/dapur...
CVE-2014-9147: Exposure of Sensitive Information to an Unauthorized Actor
Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/...
PT-2017-6329
Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.1.8 Description The issue allows remote attackers to bypass intended access restrictions. This can be achieved by executing specific functions, such as the "Install and Update" or Backup super administrator function, via t...
Fiyo CMS Cross-Site Scripting Vulnerability (CNVD-2017-24320)
Fiyo CMS is a content management system CMS for creating CMS templates. A cross-site scripting vulnerability exists in the dapur\apps\appconfig\sysconfig.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of th...
Design/Logic Flaw
Fiyo CMS 2.0.7 has XSS in dapur\apps\appconfig\sysconfig.php via the sitename parameter...
CVE-2017-13778
Fiyo CMS 2.0.7 has XSS in dapur\apps\appconfig\sysconfig.php via the sitename parameter...
CVE-2017-13778
Fiyo CMS 2.0.7 contains a Cross-Site Scripting (XSS) vulnerability in dapur/apps/app_config/sys_config.php via the site_name parameter. The root cause is improper sanitization of the site_name input, allowing arbitrary web script or HTML to be injected into pages served by the application. This a...
CVE-2017-13778
Fiyo CMS 2.0.7 has XSS in dapur\apps\appconfig\sysconfig.php via the sitename parameter...
PT-2017-13093
Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7 Description The issue concerns a cross-site scripting XSS problem. It is related to the site name parameter in the /dapur/apps/app config/sys config.php endpoint. Recommendations For Fiyo CMS version 2.0.7, update the sy...
CVE-2017-13778: Improper Neutralization of Input During Web Page Generation
Fiyo CMS 2.0.7 has XSS in dapur\apps\appconfig\sysconfig.php via the sitename parameter...
Fiyo CMS Arbitrary File Deletion Vulnerability (CNVD-2017-26594)
Fiyo CMS is a content management system CMS for creating CMS templates. A security vulnerability exists in the dapur\apps\appconfig\controller\backuper.php file in Fiyo CMS version 2.0.7. The vulnerability can be exploited by a remote attacker to delete arbitrary files using the 'file' parameter ...
Fiyo CMS dapur/app/app_user/controller/status.php file SQL injection vulnerability
Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the dapur/app/appuser/controller/status.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit this vulnerability with the help of the 'id' parameter to cause a delayed...
CVE-2017-11631
dapur/app/appuser/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter...
CVE-2017-11631
dapur/app/appuser/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter...
Directory traversal
dapur\apps\appconfig\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request, a different vulnerability than CVE-2017-8853...