CVE-2015-1512

CVE-2015-1512 affects FancyFon FAMOC prior to version 3.17.4. The issue is cross-site scripting (XSS) that allows remote attackers to inject arbitrary script/HTML via user-supplied input in (1) LoginForm[username] to ui/system/login, (2) order, or (3) myorgs to index.php. The provided documents d...

CVE-2015-1514

FancyFon FAMOC is affected by SQL injection vulnerabilities in versions prior to 3.17.4. The flaws permit remote SQL command execution via the device ID REST parameter (PATH_INFO) to /ajax.php and via the order parameter to index.php. Root cause: inadequate input filtering on these parameters. Im...