Vulnerabilities

Filters

Reset all

1 selected

26 records

Sort

Vendor: Fiyo Clear all filters

TI-2020-17958 CVE-2020-35373 · GHSA-68w6-7f8g-crh5

In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack.

LOW 28

In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00695 Published 2021-06-17 No fix listed CWE-79

TI-2018-13112 CVE-2018-18545 · GHSA-rggv-xc84-4fjv

Fiyo CMS 2.0.7 has XSS via the dapur\apps\app_user\edit_user.php name parameter.

LOW 29

Fiyo CMS 2.0.7 has XSS via the dapur\apps\app_user\edit_user.php name parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00809 Published 2018-10-21 No fix listed CWE-79

TI-2017-12555 CVE-2017-17104 · GHSA-fxm4-hhhg-x5f3

Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in…

LOW 36

Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/app_theme/libs/check_file.php via $_GET['src'] or $_GET['name'].

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01705 Published 2017-12-04 No fix listed CWE-200

TI-2017-12554 CVE-2017-17103 · GHSA-x439-2m4j-7jxg

Fiyo CMS 2.0.7 has SQL injection in /apps/app_user/sys_user.php via $_POST[name] or…

MEDIUM 40

Fiyo CMS 2.0.7 has SQL injection in /apps/app_user/sys_user.php via $_POST[name] or $_POST[email].

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01181 Published 2017-12-04 No fix listed CWE-89

TI-2017-12553 CVE-2017-17102 · GHSA-29vr-jfvx-hh86

Fiyo CMS 2.0.7 has SQL injection in /system/site.php via $_REQUEST['link'].

LOW 35

Fiyo CMS 2.0.7 has SQL injection in /system/site.php via $_REQUEST['link'].

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01084 Published 2017-12-04 No fix listed CWE-89

TI-2015-03325 CVE-2015-3934 · GHSA-78vw-cc95-476j

Multiple SQL injection vulnerabilities in Fiyo CMS 2.0_1.9.1 allow remote attackers to…

MEDIUM 48

Multiple SQL injection vulnerabilities in Fiyo CMS 2.0_1.9.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to apps/app_article/controller/rating.php or (2) user parameter to user/login…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03067 Published 2017-11-21 No fix listed CWE-89

TI-2014-07423 CVE-2014-9148 · GHSA-5hq2-6346-wf37

Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and…

MEDIUM 55

Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super administrator function via the view parameter in a direct request to fiyo/dapur…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.11447 Published 2017-10-16 No fix listed CWE-284

TI-2014-07422 CVE-2014-9147 · GHSA-4w5x-gf9f-6rv2

Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct…

MEDIUM 46

Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.11429 Published 2017-10-16 No fix listed CWE-200

TI-2017-10049 CVE-2017-13778 · GHSA-6xg6-g79q-m658

Fiyo CMS 2.0.7 has XSS in dapur\apps\app_config\sys_config.php via the site_name parameter.

LOW 28

Fiyo CMS 2.0.7 has XSS in dapur\apps\app_config\sys_config.php via the site_name parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00602 Published 2017-08-30 No fix listed CWE-79

TI-2017-08606 CVE-2017-11631 · GHSA-q5p9-j4cp-mp25

dapur/app/app_user/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter.

MEDIUM 44

dapur/app/app_user/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01044 Published 2017-07-26 No fix listed CWE-89

TI-2017-08605 CVE-2017-11630 · GHSA-7m8f-9qm8-vj35

dapur\apps\app_config\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers…

LOW 36

dapur\apps\app_config\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request, a different vulnerabil…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01773 Published 2017-07-26 No fix listed CWE-22

TI-2017-08446 CVE-2017-11419 · GHSA-7grf-fm4x-2wmw

Fiyo CMS 2.0.7 has SQL injection in /apps/app_article/controller/editor.php via $_POST['id'] and $_POST['art_title'].

MEDIUM 44

Fiyo CMS 2.0.7 has SQL injection in /apps/app_article/controller/editor.php via $_POST['id'] and $_POST['art_title'].

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.00986 Published 2017-07-18 No fix listed CWE-89

TI-2017-08445 CVE-2017-11418 · GHSA-p2hp-7xxq-8vc4

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_list.php…

MEDIUM 44

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_list.php via $_GET['cat'], $_GET['user'], $_GET['level'], and $_GET['iSortCol_'.$i].

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.00986 Published 2017-07-18 No fix listed CWE-89

TI-2017-08444 CVE-2017-11417 · GHSA-vpf3-m647-9mp8

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_status.php via $_GET['id'].

MEDIUM 44

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_status.php via $_GET['id'].

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01022 Published 2017-07-18 No fix listed CWE-89

TI-2017-08443 CVE-2017-11416 · GHSA-mv33-6wg2-qqp5

Fiyo CMS 2.0.7 has SQL injection in /apps/app_comment/controller/insert.php via the name parameter.

MEDIUM 44

Fiyo CMS 2.0.7 has SQL injection in /apps/app_comment/controller/insert.php via the name parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.00986 Published 2017-07-18 No fix listed CWE-89

TI-2017-08442 CVE-2017-11415 · GHSA-gpqh-8h4x-m827

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/sys_article.php via…

MEDIUM 44

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/sys_article.php via $_POST['parent_id'], $_POST['desc'], $_POST['keys'], and $_POST['level'].

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.00986 Published 2017-07-18 No fix listed CWE-89

TI-2017-08441 CVE-2017-11414 · GHSA-58f3-h4w2-983x

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/sys_comment.php via…

MEDIUM 44

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/sys_comment.php via $_POST['comment'], $_POST['name'], $_POST['web'], $_POST['email'], $_POST['status'], $_POST['id'], and $_REQUEST['id'].

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.00986 Published 2017-07-18 No fix listed CWE-89

TI-2017-08440 CVE-2017-11413 · GHSA-ff63-m3j8-q7gr

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/comment_status.php via $_GET['id'].

MEDIUM 44

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/comment_status.php via $_GET['id'].

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01022 Published 2017-07-18 No fix listed CWE-89

TI-2017-08439 CVE-2017-11412 · GHSA-mm85-f7x8-3mc6

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/controller/comment_status.php via $_GET['id'].

MEDIUM 44

Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/controller/comment_status.php via $_GET['id'].

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.00986 Published 2017-07-18 No fix listed CWE-89

TI-2017-08392 CVE-2017-11354 · GHSA-hxmv-r2m9-m4wr

Fiyo CMS v2.0.7 has an SQL injection vulnerability in…

MEDIUM 44

Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/app_article/sys_article.php via the name parameter in editing or adding a tag name.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.00986 Published 2017-07-17 No fix listed CWE-89

TI-2017-06361 CVE-2017-8853 · GHSA-cmv7-x2mv-whmm

Fiyo CMS v2.0.7 has an arbitrary file delete vulnerability in…

LOW 36

Fiyo CMS v2.0.7 has an arbitrary file delete vulnerability in dapur/apps/app_config/controller/backuper.php via directory traversal in the file parameter during an act=db action.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01432 Published 2017-05-09 No fix listed CWE-22

TI-2017-05261 CVE-2017-7625 · GHSA-5h6w-56p3-f39c

In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter…

MEDIUM 48

In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/app_theme/libs/save_file.php" and then execute code.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03164 Published 2017-04-10 No fix listed CWE-94

TI-2017-04573 CVE-2017-6823 · GHSA-3pwp-6v4c-x7pg

Fiyo CMS 2.0.6.1 allows remote authenticated users to gain privileges via a modified…

MEDIUM 49

Fiyo CMS 2.0.6.1 allows remote authenticated users to gain privileges via a modified level parameter to dapur/ in an app=user&act=edit action.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.08041 Published 2017-03-12 No fix listed CWE-294

TI-2014-07421 CVE-2014-9146 · GHSA-9pg7-c25m-5jpc

Multiple cross-site scripting (XSS) vulnerabilities in Fiyo CMS 2.0.1.8 allow remote…

LOW 25

Multiple cross-site scripting (XSS) vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to inject arbitrary web script or HTML via the (1) view, (2) id, (3) page, or (4) app parameter to the default URI or the (5)…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02519 Published 2015-04-14 No fix listed CWE-79

TI-2014-07420 CVE-2014-9145 · GHSA-mjp5-r22c-mmgr

Multiple SQL injection vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to…

LOW 37

Multiple SQL injection vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an edit action to dapur/index.php; (2) cat, (3) user, or (4) level parameter…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0207 Published 2015-04-14 No fix listed CWE-89