197 matches found
CVE-2017-13778
Fiyo CMS 2.0.7 contains a Cross-Site Scripting (XSS) vulnerability in dapur/apps/app_config/sys_config.php via the site_name parameter. The root cause is improper sanitization of the site_name input, allowing arbitrary web script or HTML to be injected into pages served by the application. This a...
Fiyo CMS dapur/app/app_user/controller/status.php file SQL injection vulnerability
Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the dapur/app/appuser/controller/status.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit this vulnerability with the help of the 'id' parameter to cause a delayed...
Fiyo CMS Arbitrary File Deletion Vulnerability (CNVD-2017-26594)
Fiyo CMS is a content management system CMS for creating CMS templates. A security vulnerability exists in the dapur\apps\appconfig\controller\backuper.php file in Fiyo CMS version 2.0.7. The vulnerability can be exploited by a remote attacker to delete arbitrary files using the 'file' parameter ...
Directory traversal
dapur\apps\appconfig\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request, a different vulnerability than CVE-2017-8853...
CVE-2017-11631
dapur/app/appuser/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter...
Sql injection
dapur/app/appuser/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter...
CVE-2017-11630
dapur\apps\appconfig\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request, a different vulnerability than CVE-2017-8853...
CVE-2017-11631
dapur/app/appuser/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter...
CVE-2017-11631
dapur/app/appuser/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter...
CVE-2017-11630
dapur\apps\appconfig\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request, a different vulnerability than CVE-2017-8853...
CVE-2017-11631
CVE-2017-11631 affects Fiyo CMS 2.0.7: the file dapur/app/app_user/controller/status.php exposes an SQL injection vulnerability via the id parameter. The vulnerability arises from unsafely interpolating the id value into a SQL query, potentially allowing an attacker to perform arbitrary queries. ...
CVE-2017-11630
Summary (CVE-2017-11630) Fiyo CMS 2.0.7 is affected by an arbitrary file deletion vulnerability in the file parameter of the type=database request, triggered via directory traversal in dapur\apps\app_config\controller\backuper.php. The issue allows remote attackers to delete arbitrary files. The ...
Fiyo CMS dapur/apps/app_article/sys_article.php file SQL injection vulnerability
Fiyo CMS is a content management system CMS for creating CMS templates. A SQL injection vulnerability exists in the dapur/apps/apparticle/sysarticle.php file in Fiyo CMS version 2.0.7. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands...
CVE-2017-11412
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/appcomment/controller/commentstatus.php via $GET'id'...
CVE-2017-11413
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/controller/commentstatus.php via $GET'id'...
CVE-2017-11418
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/controller/articlelist.php via $GET'cat', $GET'user', $GET'level', and $GET'iSortCol'.$i...
Sql injection
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/controller/articlestatus.php via $GET'id'...
CVE-2017-11415
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/apparticle/sysarticle.php via $POST'parentid', $POST'desc', $POST'keys', and $POST'level'...