fiyo cms vulnerabilities and fixes

Recent CVEs affecting fiyo cms, with upgrade or downgrade steps. 26 tracked.

Also searched as: fiyocms.

fiyo cms has 26 tracked vulnerabilities, 13 critical. A fixed release or vendor patch exists for 2. Most recent: 2021-06-17. Highest priority: CVE-2014-9148 (score 68/100).

• CVE-2020-35373 MEDIUM 6.1 DOWNGRADE In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack.
• CVE-2018-18545 MEDIUM 6.1 DOWNGRADE Fiyo CMS 2.0.7 has XSS via the dapur\apps\app_user\edit_user.php name parameter.
• CVE-2017-8853 HIGH 7.5 DOWNGRADE Fiyo CMS v2.0.7 has an arbitrary file delete vulnerability in dapur/apps/app_config/controller/backuper.php vi
• CVE-2017-7625 CRITICAL 9.8 DOWNGRADE In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/app_t
• CVE-2017-6823 HIGH 8.8 DOWNGRADE Fiyo CMS 2.0.6.1 allows remote authenticated users to gain privileges via a modified level parameter to dapur/
• CVE-2017-17104 HIGH 7.5 DOWNGRADE Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/app_theme/libs/check_file.php via $_GET[
• CVE-2017-17103 HIGH 8.8 DOWNGRADE Fiyo CMS 2.0.7 has SQL injection in /apps/app_user/sys_user.php via $_POST[name] or $_POST[email]
• CVE-2017-17102 HIGH 7.5 DOWNGRADE Fiyo CMS 2.0.7 has SQL injection in /system/site.php via $_REQUEST['link'].
• CVE-2017-13778 MEDIUM 6.1 DOWNGRADE Fiyo CMS 2.0.7 has XSS in dapur\apps\app_config\sys_config.php via the site_name parameter.
• CVE-2017-11631 CRITICAL 9.8 DOWNGRADE dapur/app/app_user/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter.
• CVE-2017-11630 HIGH 7.5 DOWNGRADE dapur\apps\app_config\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary fi
• CVE-2017-11419 CRITICAL 9.8 DOWNGRADE Fiyo CMS 2.0.7 has SQL injection in /apps/app_article/controller/editor.php via $_POST['id'] and $_POST['art_t
• CVE-2017-11418 CRITICAL 9.8 DOWNGRADE Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_list.php via $_GET['cat'], $_GET
• CVE-2017-11417 CRITICAL 9.8 DOWNGRADE Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_status.php via $_GET['id'].
• CVE-2017-11416 CRITICAL 9.8 DOWNGRADE Fiyo CMS 2.0.7 has SQL injection in /apps/app_comment/controller/insert.php via the name parameter.
• CVE-2017-11415 CRITICAL 9.8 DOWNGRADE Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/sys_article.php via $_POST['parent_id'], $_POST['de
• CVE-2017-11414 CRITICAL 9.8 DOWNGRADE Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/sys_comment.php via $_POST['comment'], $_POST['name
• CVE-2017-11413 CRITICAL 9.8 DOWNGRADE Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/comment_status.php via $_GET['id'].
• CVE-2017-11412 CRITICAL 9.8 DOWNGRADE Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/controller/comment_status.php via $_GET['id'].
• CVE-2017-11354 CRITICAL 9.8 DOWNGRADE Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/app_article/sys_article.php via the name para
• CVE-2015-3934 CRITICAL 9.8 DOWNGRADE Multiple SQL injection vulnerabilities in Fiyo CMS 2.0_1.9.1 allow remote attackers to execute arbitrary SQL c
• CVE-2014-9148 CRITICAL 9.8 UPGRADE Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install a
• CVE-2014-9147 HIGH 7.5 UPGRADE Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database
• CVE-2014-9146 MEDIUM 4.3 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to inject arbit
• CVE-2014-9145 HIGH 7.5 DOWNGRADE Multiple SQL injection vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to execute arbitrary SQL com
• CVE-2014-4032 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in apps/app_comment/form_comment.php in Fiyo CMS 1.5.7 allows remote

FAQ

How do I fix fiyo cms vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is fiyo cms being exploited right now?

None of the tracked fiyo cms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which fiyo cms CVE should I patch first?

CVE-2014-9148 currently ranks highest (68/100): Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install a.

RSS feed for fiyo cms · ← Back to latest CVEs