Finecms

    Dashboard / Vendors

    Products: 1
    Vulnerabilities: 12
    Known Exploited: 0
    6
    Critical Level Threats
    1
    High Level Threats
    5
    Medium Level Threats
    0
    Low Level Threats

    Vulnerabilities

    100806040200
    JanFebMarAprMayJunJulAugSepOctNovDec
    Critical Level Threats
    High Level Threats
    Medium Level Threats
    Low Level Threats

    Products Security index

    Actions
    Items Per Page

    Vulnerabilities

    CVE-2018-18191

    Cross-site request forgery (CSRF) vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password.

    Last Modified: Nov 21, 2024
    Published: Oct 09, 2018

    CVE-2018-7476

    controllers/admin/Linkage.php in dayrui FineCms 5.3.0 has Cross Site Scripting (XSS) via the id or lid parameter in a c=linkage,m=import request to admin.php, because the xss_clean protection mechanism is defeated by crafted input that lacks a '<' or '>' character.

    Last Modified: Nov 21, 2024
    Published: Feb 25, 2018

    CVE-2018-6893

    controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statement, lacks effective filtering.

    Last Modified: Nov 21, 2024
    Published: Feb 12, 2018

    CVE-2017-16920

    v5/config/system.php in dayrui FineCms 5.2.0 has a default SYS_KEY value and does not require key regeneration for each installation, which allows remote attackers to upload arbitrary .php files via a member api swfupload action to index.php.

    Last Modified: Apr 20, 2025
    Published: Nov 21, 2017

    CVE-2017-16866

    dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting (XSS) in core/M_Controller.php via the DR_URI field.

    Last Modified: Apr 20, 2025
    Published: Nov 16, 2017
    Items Per Page
    Finecms Vulnerabilities & Security CVEs | CVE-DB