CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 07/09/2017 |
| CVE-2017-14192 | MEDIUM6.1 | The checktitle function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the module field. | 07/09/2017 |
| CVE-2017-13697 | MEDIUM6.1 | controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable. | 25/08/2017 |
| CVE-2017-12774 | CRITICAL9.8 | finecms in 1.9.5\controllers\member\ContentController.php allows remote attackers to operate website database | 09/08/2017 |
| CVE-2017-11167 | CRITICAL9.8 | FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', sequence in a domain name, as demonstrated by the ',phpinfo() input value. | 12/07/2017 |
| CVE-2017-11178 | HIGH7.5 | In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. For example, this can be used to overwrite a .php file because the file extension is not checked. | 12/07/2017 |
| CVE-2017-10973 | MEDIUM6.5 | In FineCMS before 2017-07-06, application/lib/ajax/get_image_data.php has SSRF, related to requests for non-image files with a modified HTTP Host header. | 06/07/2017 |
| CVE-2017-6511 | MEDIUM6.1 | andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation of the action parameter in application/classes/application.php. | 07/03/2017 |