Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
33 results
Oct 9, 2018Cross-site request forgery (CSRF) vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's CVE-2018-18191 · Other software · Finecms · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Feb 25, 2018controllers/admin/Linkage.php in dayrui FineCms 5.3.0 has Cross Site Scripting (XSS) via the id or lid parameter in a c=linkage,m=import request to admin.php, bCVE-2018-7476 · Other software · Finecms · reported by MITREMedium 6.1
controllers/admin/Linkage.php in dayrui FineCms 5.3.0 has Cross Site Scripting (XSS) via the id or lid parameter in a c=linkage,m=import request to admin.php, because the xss_clean protection mechanism is defeated by crafted input that lacks a '<' or '>' character.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2018controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statemenCVE-2018-6893 · Other software · Finecms · reported by MITRECritical 9.8
controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statement, lacks effective filtering.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxianzhi.aliyun.comxianzhi.aliyun.com
Jan 9, 2018rui Li finecms 5.0.10 is vulnerable to a reflected XSS in the file Weixin.php.CVE-2017-1000429 · Other software · Finecms Project · reported by MITREMedium 6.1
rui Li finecms 5.0.10 is vulnerable to a reflected XSS in the file Weixin.php.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlucifaer.comlucifaer.com
Nov 21, 2017v5/config/system.php in dayrui FineCms 5.2.0 has a default SYS_KEY value and does not require key regeneration for each installation, which allows remote attackCVE-2017-16920 · Other software · Finecms · reported by MITRECritical 9.8
v5/config/system.php in dayrui FineCms 5.2.0 has a default SYS_KEY value and does not require key regeneration for each installation, which allows remote attackers to upload arbitrary .php files via a member api swfupload action to index.php.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitee.comuser-images.githubusercontent.com
Nov 16, 2017dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting (XSS) in core/M_Controller.php via the DR_URI field.CVE-2017-16866 · Other software · Finecms · reported by MITREMedium 6.1
dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting (XSS) in core/M_Controller.php via the DR_URI field.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2017The call_msg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to the Referer HTTP header with Internet Explorer.CVE-2017-14195 · Other software · Finecms Project · reported by MITREMedium 6.1
The call_msg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to the Referer HTTP header with Internet Explorer.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbendawang.sitebendawang.site
Sep 7, 2017The out function in controllers/member/Login.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer.CVE-2017-14194 · Other software · Finecms Project · reported by MITREMedium 6.1
The out function in controllers/member/Login.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbendawang.sitebendawang.site
Sep 7, 2017The oauth function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer.CVE-2017-14193 · Other software · Finecms Project · reported by MITREMedium 6.1
The oauth function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbendawang.sitebendawang.site
Sep 7, 2017The checktitle function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the module field.CVE-2017-14192 · Other software · Finecms Project · reported by MITREMedium 6.1
The checktitle function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the module field.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbendawang.sitebendawang.site
Aug 25, 2017controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable.CVE-2017-13697 · Other software · Finecms Project · reported by MITREMedium 6.1
controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbendawang.sitebendawang.site
Aug 9, 2017finecms in 1.9.5\controllers\member\ContentController.php allows remote attackers to operate website databaseCVE-2017-12774 · Other software · Finecms Project · reported by MITRECritical 9.8
finecms in 1.9.5\controllers\member\ContentController.php allows remote attackers to operate website database
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2017dayrui FineCms through 5.0.10 has Cross Site Scripting (XSS) in controllers/api.php via the function parameter in a c=api&m=data2 request.CVE-2017-11629 · Other software · Finecms · reported by MITREMedium 6.1
dayrui FineCms through 5.0.10 has Cross Site Scripting (XSS) in controllers/api.php via the function parameter in a c=api&m=data2 request.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlorexxar.cnlorexxar.cn
Jul 23, 2017dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php.CVE-2017-11586 · Other software · Finecms · reported by MITREMedium 6.1
dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlorexxar.cnlorexxar.cn
Jul 23, 2017dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libraries/Template.php, aka Eval Injection.CVE-2017-11585 · Other software · Finecms · reported by MITRECritical 9.8
dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libraries/Template.php, aka Eval Injection.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlorexxar.cnlorexxar.cn
Jul 23, 2017dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.CVE-2017-11584 · Other software · Finecms · reported by MITRECritical 9.8
dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.php.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlorexxar.cnlorexxar.cn
Jul 23, 2017dayrui FineCms 5.0.9 has SQL Injection via the catid parameter in an action=related request to libraries/Template.php.CVE-2017-11583 · Other software · Finecms · reported by MITRECritical 9.8
dayrui FineCms 5.0.9 has SQL Injection via the catid parameter in an action=related request to libraries/Template.php.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlorexxar.cnlorexxar.cn
Jul 23, 2017dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to libraries/Template.php.CVE-2017-11582 · Other software · Finecms · reported by MITRECritical 9.8
dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to libraries/Template.php.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlorexxar.cnlorexxar.cn
Jul 23, 2017dayrui FineCms 5.0.9 has Cross Site Scripting (XSS) in admin/Login.php via a payload in the username field that does not begin with a '<' character.CVE-2017-11581 · Other software · Finecms · reported by MITREMedium 6.1
dayrui FineCms 5.0.9 has Cross Site Scripting (XSS) in admin/Login.php via a payload in the username field that does not begin with a '<' character.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlorexxar.cnlorexxar.cn
Jul 12, 2017FineCMS through 2017-07-12 allows XSS in visitors.php because JavaScript in visited URLs is not restricted either during logging or during the reading of logs, CVE-2017-11202 · Other software · Finecms Project · reported by MITREMedium 6.1
FineCMS through 2017-07-12 allows XSS in visitors.php because JavaScript in visited URLs is not restricted either during logging or during the reading of logs, a different vulnerability than CVE-2017-11180.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlorexxar.cnlorexxar.cn
Jul 12, 2017application/core/controller/images.php in FineCMS through 2017-07-12 allows remote authenticated admins to conduct XSS attacks by uploading an image via a routeCVE-2017-11201 · Other software · Finecms Project · reported by MITREMedium 5.4
application/core/controller/images.php in FineCMS through 2017-07-12 allows remote authenticated admins to conduct XSS attacks by uploading an image via a route=images action.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlorexxar.cnlorexxar.cn
Jul 12, 2017SQL Injection exists in FineCMS through 2017-07-12 via the application/core/controller/excludes.php visitor_ip parameter.CVE-2017-11200 · Other software · Finecms Project · reported by MITREHigh 8.8
SQL Injection exists in FineCMS through 2017-07-12 via the application/core/controller/excludes.php visitor_ip parameter.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlorexxar.cnlorexxar.cn
Jul 12, 2017Cross-site scripting (XSS) vulnerability in /application/lib/ajax/get_image.php in FineCMS through 2017-07-12 allows remote attackers to inject arbitrary web scCVE-2017-11198 · Other software · Finecms Project · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in /application/lib/ajax/get_image.php in FineCMS through 2017-07-12 allows remote attackers to inject arbitrary web script or HTML via the folder, id, or name parameter.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlorexxar.cnlorexxar.cn
Jul 12, 2017FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', sequence in a domain CVE-2017-11167 · Other software · Finecms Project · reported by MITRECritical 9.8
FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', sequence in a domain name, as demonstrated by the ',phpinfo() input value.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2017FineCMS through 2017-07-11 has stored XSS in the logging functionality, as demonstrated by an XSS payload in (1) the User-Agent header of an HTTP request or (2)CVE-2017-11180 · Other software · Finecms Project · reported by MITREMedium 6.1
FineCMS through 2017-07-11 has stored XSS in the logging functionality, as demonstrated by an XSS payload in (1) the User-Agent header of an HTTP request or (2) the username entered on the login screen.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2017FineCMS through 2017-07-11 has stored XSS in route=admin when modifying user information, and in route=register when registering a user account.CVE-2017-11179 · Other software · Finecms Project · reported by MITREMedium 6.1
FineCMS through 2017-07-11 has stored XSS in route=admin when modifying user information, and in route=register when registering a user account.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2017In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents and filename parameterCVE-2017-11178 · Other software · Finecms Project · reported by MITREHigh 7.5
In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. For example, this can be used to overwrite a .php file because the file extension is not checked.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2017In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "<?php" in a route=template rCVE-2017-10968 · Other software · Finecms Project · reported by MITRECritical 9.8
In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "<?php" in a route=template request.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2017In FineCMS before 2017-07-06, application/lib/ajax/get_image_data.php has SSRF, related to requests for non-image files with a modified HTTP Host header.CVE-2017-10973 · Other software · Finecms Project · reported by MITREMedium 6.5
In FineCMS before 2017-07-06, application/lib/ajax/get_image_data.php has SSRF, related to requests for non-image files with a modified HTTP Host header.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2017In FineCMS before 2017-07-06, application\core\controller\config.php allows XSS in the (1) key_name, (2) key_value, and (3) meaning parameters.CVE-2017-10967 · Other software · Finecms Project · reported by MITREMedium 6.1
In FineCMS before 2017-07-06, application\core\controller\config.php allows XSS in the (1) key_name, (2) key_value, and (3) meaning parameters.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2017andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search parameter to index.php in a route=search action.CVE-2017-9252 · Other software · Finecms Project · reported by MITREMedium 6.1
andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search parameter to index.php in a route=search action.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2017andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the sitename parameter to admin.php.CVE-2017-9251 · Other software · Finecms Project · reported by MITREMedium 6.1
andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the sitename parameter to admin.php.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2017andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation of the action parameter in application/classes/appCVE-2017-6511 · Other software · Finecms Project · reported by MITREMedium 6.1
andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation of the action parameter in application/classes/application.php.
- Product
- Finecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.