finecms vulnerabilities and fixes

Recent CVEs affecting finecms, with upgrade or downgrade steps. 33 tracked.

finecms has 33 tracked vulnerabilities, 9 critical. A fixed release or vendor patch exists for 8. Most recent: 2018-10-09. Highest priority: CVE-2017-11585 (score 65/100).

• CVE-2018-7476 MEDIUM 6.1 DOWNGRADE controllers/admin/Linkage.php in dayrui FineCms 5.3.0 has Cross Site Scripting (XSS) via the id or lid paramet
• CVE-2018-6893 CRITICAL 9.8 DOWNGRADE controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktit
• CVE-2018-18191 HIGH 8.8 DOWNGRADE Cross-site request forgery (CSRF) vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allo
• CVE-2017-9252 MEDIUM 6.1 MITIGATE andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search par
• CVE-2017-9251 MEDIUM 6.1 MITIGATE andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the sitename parameter to admin.php.
• CVE-2017-6511 MEDIUM 6.1 UPGRADE andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation
• CVE-2017-16920 CRITICAL 9.8 DOWNGRADE v5/config/system.php in dayrui FineCms 5.2.0 has a default SYS_KEY value and does not require key regeneration
• CVE-2017-16866 MEDIUM 6.1 DOWNGRADE dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting (XSS) in core/M_Controller.php via the DR_URI
• CVE-2017-14195 MEDIUM 6.1 DOWNGRADE The call_msg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to the Referer H
• CVE-2017-14194 MEDIUM 6.1 DOWNGRADE The out function in controllers/member/Login.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP
• CVE-2017-14193 MEDIUM 6.1 DOWNGRADE The oauth function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP
• CVE-2017-14192 MEDIUM 6.1 DOWNGRADE The checktitle function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the module f
• CVE-2017-13697 MEDIUM 6.1 DOWNGRADE controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable.
• CVE-2017-12774 CRITICAL 9.8 DOWNGRADE finecms in 1.9.5\controllers\member\ContentController.php allows remote attackers to operate website database
• CVE-2017-11629 MEDIUM 6.1 UPGRADE dayrui FineCms through 5.0.10 has Cross Site Scripting (XSS) in controllers/api.php via the function parameter
• CVE-2017-11586 MEDIUM 6.1 UPGRADE dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/W
• CVE-2017-11585 CRITICAL 9.8 DOWNGRADE dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libra
• CVE-2017-11584 CRITICAL 9.8 UPGRADE dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form
• CVE-2017-11583 CRITICAL 9.8 UPGRADE dayrui FineCms 5.0.9 has SQL Injection via the catid parameter in an action=related request to libraries/Templ
• CVE-2017-11582 CRITICAL 9.8 UPGRADE dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to li
• CVE-2017-11581 MEDIUM 6.1 DOWNGRADE dayrui FineCms 5.0.9 has Cross Site Scripting (XSS) in admin/Login.php via a payload in the username field tha
• CVE-2017-11202 MEDIUM 6.1 MITIGATE FineCMS through 2017-07-12 allows XSS in visitors.php because JavaScript in visited URLs is not restricted eit
• CVE-2017-11201 MEDIUM 5.4 MITIGATE application/core/controller/images.php in FineCMS through 2017-07-12 allows remote authenticated admins to con
• CVE-2017-11200 HIGH 8.8 MITIGATE SQL Injection exists in FineCMS through 2017-07-12 via the application/core/controller/excludes.php visitor_ip
• CVE-2017-11198 MEDIUM 6.1 MITIGATE Cross-site scripting (XSS) vulnerability in /application/lib/ajax/get_image.php in FineCMS through 2017-07-12
• CVE-2017-11180 MEDIUM 6.1 MITIGATE FineCMS through 2017-07-11 has stored XSS in the logging functionality, as demonstrated by an XSS payload in (
• CVE-2017-11179 MEDIUM 6.1 MITIGATE FineCMS through 2017-07-11 has stored XSS in route=admin when modifying user information, and in route=registe
• CVE-2017-11178 HIGH 7.5 UPGRADE In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbit
• CVE-2017-11167 CRITICAL 9.8 DOWNGRADE FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action t
• CVE-2017-10973 MEDIUM 6.5 UPGRADE In FineCMS before 2017-07-06, application/lib/ajax/get_image_data.php has SSRF, related to requests for non-im
• CVE-2017-10968 CRITICAL 9.8 MITIGATE In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by pl
• CVE-2017-10967 MEDIUM 6.1 MITIGATE In FineCMS before 2017-07-06, application\core\controller\config.php allows XSS in the (1) key_name, (2) key_v
• CVE-2017-1000429 MEDIUM 6.1 DOWNGRADE rui Li finecms 5.0.10 is vulnerable to a reflected XSS in the file Weixin.php.

FAQ

How do I fix finecms vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is finecms being exploited right now?

None of the tracked finecms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which finecms CVE should I patch first?

CVE-2017-11585 currently ranks highest (65/100): dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libra.

RSS feed for finecms · ← Back to latest CVEs