PatchTheCVEfinecms vulnerabilities
Recent CVEs affecting finecms products. 5 tracked.
finecms has 5 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 0. Most recent: 2018-10-09. Highest priority: CVE-2018-6893 (score 60/100).
- CVE-2018-7476 MEDIUM 6.1 DOWNGRADE controllers/admin/Linkage.php in dayrui FineCms 5.3.0 has Cross Site Scripting (XSS) via the id or lid paramet
- CVE-2018-6893 CRITICAL 9.8 DOWNGRADE controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktit
- CVE-2018-18191 HIGH 8.8 DOWNGRADE Cross-site request forgery (CSRF) vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allo
- CVE-2017-16920 CRITICAL 9.8 DOWNGRADE v5/config/system.php in dayrui FineCms 5.2.0 has a default SYS_KEY value and does not require key regeneration
- CVE-2017-16866 MEDIUM 6.1 DOWNGRADE dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting (XSS) in core/M_Controller.php via the DR_URI
FAQ
How do I fix finecms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is finecms being exploited right now?
None of the tracked finecms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which finecms CVE should I patch first?
CVE-2018-6893 currently ranks highest (60/100): controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktit.