Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
FiyoFiyo Cms

13 matches found

CVE
CVE•added 2017/10/16 3:29 p.m.•51 views

CVE-2014-9148

Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super administrator function via the view parameter in a direct request to fiyo/dapur.

9.8CVSS9.4AI score0.24232EPSS
CVE
CVE•added 2017/07/18 5:29 a.m.•49 views

CVE-2017-11414

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/sys_comment.php via $_POST['comment'], $_POST['name'], $_POST['web'], $_POST['email'], $_POST['status'], $_POST['id'], and $_REQUEST['id'].

9.8CVSS9.8AI score0.00233EPSS
CVE
CVE•added 2017/07/18 5:29 a.m.•47 views

CVE-2017-11418

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_list.php via $_GET['cat'], $_GET['user'], $_GET['level'], and $GET['iSortCol '.$i].

9.8CVSS9.8AI score0.00233EPSS
CVE
CVE•added 2017/04/10 5:59 p.m.•46 views

CVE-2017-7625

In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/app_theme/libs/save_file.php" and then execute code.

9.8CVSS9.4AI score0.0146EPSS
CVE
CVE•added 2017/07/17 1:18 p.m.•45 views

CVE-2017-11354

Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/app_article/sys_article.php via the name parameter in editing or adding a tag name.

9.8CVSS9.7AI score0.00233EPSS
CVE
CVE•added 2017/11/21 3:29 p.m.•44 views

CVE-2015-3934

Multiple SQL injection vulnerabilities in Fiyo CMS 2.0_1.9.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to apps/app_article/controller/rating.php or (2) user parameter to user/login.

9.8CVSS10AI score0.01345EPSS
CVE
CVE•added 2017/07/18 5:29 a.m.•44 views

CVE-2017-11416

Fiyo CMS 2.0.7 has SQL injection in /apps/app_comment/controller/insert.php via the name parameter.

9.8CVSS9.8AI score0.00233EPSS
CVE
CVE•added 2017/07/18 5:29 a.m.•43 views

CVE-2017-11417

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_status.php via $_GET['id'].

9.8CVSS9.8AI score0.00233EPSS
CVE
CVE•added 2017/07/18 5:29 a.m.•40 views

CVE-2017-11413

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/comment_status.php via $_GET['id'].

9.8CVSS9.8AI score0.00233EPSS
CVE
CVE•added 2017/07/18 5:29 a.m.•40 views

CVE-2017-11415

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/sys_article.php via $_POST['parent_id'], $_POST['desc'], $_POST['keys'], and $_POST['level'].

9.8CVSS9.8AI score0.00233EPSS
CVE
CVE•added 2017/07/18 5:29 a.m.•39 views

CVE-2017-11412

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/controller/comment_status.php via $_GET['id'].

9.8CVSS9.8AI score0.00233EPSS
CVE
CVE•added 2017/07/18 5:29 a.m.•36 views

CVE-2017-11419

Fiyo CMS 2.0.7 has SQL injection in /apps/app_article/controller/editor.php via $_POST['id'] and $_POST['art_title'].

9.8CVSS9.8AI score0.00233EPSS
CVE
CVE•added 2017/07/26 8:29 a.m.•35 views

CVE-2017-11631

dapur/app/app_user/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter.

9.8CVSS9.8AI score0.00233EPSS