206 matches found
Sql injection
dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.php...
CVE-2017-11584
dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.php...
CVE-2017-11583
FineCMS 5.0.9 has a SQL injection in libraries/Template.php via the catid parameter in an action=related request. Impact per CNVD/NVD records includes potential disclosure of all databases. No patch version or remediation is explicitly provided in the connected documents. Exploitation details are...
CVE-2017-11584
dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.php...
CVE-2017-11583: Improper Neutralization of Special Elements used in an SQL Command
dayrui FineCms 5.0.9 has SQL Injection via the catid parameter in an action=related request to libraries/Template.php...
CVE-2017-11585: Improper Control of Generation of Code
dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libraries/Template.php, aka Eval Injection...
CVE-2017-11582
CVE-2017-11582 concerns dayrui FineCms 5.0.9, with a SQL Injection vulnerability in the libraries/Template.php file. The flaw is exploitable via the num parameter in requests for action=related or action=tags, enabling a remote attacker to execute arbitrary SQL commands. Multiple sources in the c...
CVE-2017-11582
dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to libraries/Template.php...
CVE-2017-11583
dayrui FineCms 5.0.9 has SQL Injection via the catid parameter in an action=related request to libraries/Template.php...
CVE-2017-11584: Improper Neutralization of Special Elements used in an SQL Command
dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.php...
CVE-2017-11582: Improper Neutralization of Special Elements used in an SQL Command
dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to libraries/Template.php...
CVE-2017-11584
dayrui FineCms 5.0.9 is affected by an SQL Injection in the field parameter used in actions=module, action=member, action=form, or action=related, targeting libraries/Template.php. The vulnerability is described across multiple sources (NVD/CNVD/PRION/CVE lists) with no explicit public fix/versio...
Arbitrary Code Execution
twig is vulnerable to arbitrary code execution. Attackers can execute code by leveraging a flaw in the displayBlock function in Template.php through the self variable. This can only be exploited when Sandbox mode is enabled...
FineCMS multi vulnerablity
Reflected XSS in getimage.php Technical Description: file /application/lib/ajax/getimage.php the $POST'id' and $POST'name' and $GET'folder' without any validated, sanitised or output encoded. Proof of ConceptPoC http://yourfinecms/application/lib/ajax/getimage.php?folder=1 POST: id=1"alert1&name=...
CVE-2017-10968: Improper Control of Generation of Code
In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "...
CVE-2016-5834
Cross-site scripting XSS vulnerability in the wpgetattachmentlink function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833...
CVE-2016-5834
Cross-site scripting XSS vulnerability in the wpgetattachmentlink function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833...
CVE-2016-5834
CVE-2016-5834 corresponds to a cross-site scripting (XSS) vulnerability in WordPress where the wp_get_attachment_link function in wp-includes/post-template.php could be exploited by a crafted attachment name to inject arbitrary script or HTML. Affected product: WordPress prior to version 4.5.3. R...
CVE-2016-5834: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the wpgetattachmentlink function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833...