Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
26 results
Jun 17, 2021In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack.CVE-2020-35373 · Other software · Fiyo · reported by MITREMedium 6.1
In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack.
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordloganclaw.comloganclaw.com
Oct 20, 2018Fiyo CMS 2.0.7 has XSS via the dapur\apps\app_user\edit_user.php name parameter.CVE-2018-18545 · Other software · Fiyo · reported by MITREMedium 6.1
Fiyo CMS 2.0.7 has XSS via the dapur\apps\app_user\edit_user.php name parameter.
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2017Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/app_theme/libs/check_file.php via $_GET['src'] or $_GET['name'].CVE-2017-17104 · Other software · Fiyo · reported by MITREHigh 7.5
Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/app_theme/libs/check_file.php via $_GET['src'] or $_GET['name'].
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2017Fiyo CMS 2.0.7 has SQL injection in /apps/app_user/sys_user.php via $_POST[name] or $_POST[email].CVE-2017-17103 · Other software · Fiyo · reported by MITREHigh 8.8
Fiyo CMS 2.0.7 has SQL injection in /apps/app_user/sys_user.php via $_POST[name] or $_POST[email]. This vulnerability can lead to escalation from normal user privileges to administrator privileges.
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2017Fiyo CMS 2.0.7 has SQL injection in /system/site.php via $_REQUEST['link'].CVE-2017-17102 · Other software · Fiyo · reported by MITREHigh 7.5
Fiyo CMS 2.0.7 has SQL injection in /system/site.php via $_REQUEST['link'].
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2017Multiple SQL injection vulnerabilities in Fiyo CMS 2.0_1.9.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to apps/app_articCVE-2015-3934 · Other software · Fiyo · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in Fiyo CMS 2.0_1.9.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to apps/app_article/controller/rating.php or (2) user parameter to user/login.
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 16, 2017Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super administrator functCVE-2014-9148 · Other software · Fiyo · reported by MITRECritical 9.8
Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super administrator function via the view parameter in a direct request to fiyo/dapur.
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Oct 16, 2017Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/.CVE-2014-9147 · Other software · Fiyo · reported by MITREHigh 7.5
Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/.
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Aug 30, 2017Fiyo CMS 2.0.7 has XSS in dapur\apps\app_config\sys_config.php via the site_name parameter.CVE-2017-13778 · Other software · Fiyo · reported by MITREMedium 6.1
Fiyo CMS 2.0.7 has XSS in dapur\apps\app_config\sys_config.php via the site_name parameter.
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2017dapur/app/app_user/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter.CVE-2017-11631 · Other software · Fiyo · reported by MITRECritical 9.8
dapur/app/app_user/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter.
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2017dapur\apps\app_config\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal sequences in the file CVE-2017-11630 · Other software · Fiyo · reported by MITREHigh 7.5
dapur\apps\app_config\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request, a different vulnerability than CVE-2017-8853.
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2017Fiyo CMS 2.0.7 has SQL injection in /apps/app_article/controller/editor.php via $_POST['id'] and $_POST['art_title'].CVE-2017-11419 · Other software · Fiyo · reported by MITRECritical 9.8
Fiyo CMS 2.0.7 has SQL injection in /apps/app_article/controller/editor.php via $_POST['id'] and $_POST['art_title'].
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2017Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_list.php via $_GET['cat'], $_GET['user'], $_GET['level'], and $_GET['iSortCol_'.$iCVE-2017-11418 · Other software · Fiyo · reported by MITRECritical 9.8
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_list.php via $_GET['cat'], $_GET['user'], $_GET['level'], and $_GET['iSortCol_'.$i].
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2017Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_status.php via $_GET['id'].CVE-2017-11417 · Other software · Fiyo · reported by MITRECritical 9.8
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_status.php via $_GET['id'].
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2017Fiyo CMS 2.0.7 has SQL injection in /apps/app_comment/controller/insert.php via the name parameter.CVE-2017-11416 · Other software · Fiyo · reported by MITRECritical 9.8
Fiyo CMS 2.0.7 has SQL injection in /apps/app_comment/controller/insert.php via the name parameter.
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2017Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/sys_article.php via $_POST['parent_id'], $_POST['desc'], $_POST['keys'], and $_POST['level'].CVE-2017-11415 · Other software · Fiyo · reported by MITRECritical 9.8
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/sys_article.php via $_POST['parent_id'], $_POST['desc'], $_POST['keys'], and $_POST['level'].
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2017Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/sys_comment.php via $_POST['comment'], $_POST['name'], $_POST['web'], $_POST['email'], $_POST['statusCVE-2017-11414 · Other software · Fiyo · reported by MITRECritical 9.8
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/sys_comment.php via $_POST['comment'], $_POST['name'], $_POST['web'], $_POST['email'], $_POST['status'], $_POST['id'], and $_REQUEST['id'].
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2017Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/comment_status.php via $_GET['id'].CVE-2017-11413 · Other software · Fiyo · reported by MITRECritical 9.8
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/comment_status.php via $_GET['id'].
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2017Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/controller/comment_status.php via $_GET['id'].CVE-2017-11412 · Other software · Fiyo · reported by MITRECritical 9.8
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/controller/comment_status.php via $_GET['id'].
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2017Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/app_article/sys_article.php via the name parameter in editing or adding a tag name.CVE-2017-11354 · Other software · Fiyo · reported by MITRECritical 9.8
Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/app_article/sys_article.php via the name parameter in editing or adding a tag name.
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2017Fiyo CMS v2.0.7 has an arbitrary file delete vulnerability in dapur/apps/app_config/controller/backuper.php via directory traversal in the file parameter duringCVE-2017-8853 · Other software · Fiyo · reported by MITREHigh 7.5
Fiyo CMS v2.0.7 has an arbitrary file delete vulnerability in dapur/apps/app_config/controller/backuper.php via directory traversal in the file parameter during an act=db action.
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2017In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/app_theme/libs/save_file.php" and then execute code.CVE-2017-7625 · Other software · Fiyo · reported by MITRECritical 9.8
In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/app_theme/libs/save_file.php" and then execute code.
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Mar 12, 2017Fiyo CMS 2.0.6.1 allows remote authenticated users to gain privileges via a modified level parameter to dapur/ in an app=user&act=edit action.CVE-2017-6823 · Other software · Fiyo · reported by MITREHigh 8.8
Fiyo CMS 2.0.6.1 allows remote authenticated users to gain privileges via a modified level parameter to dapur/ in an app=user&act=edit action.
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrungga.blogspot.co.idsecurityfocus.com
Apr 14, 2015Multiple cross-site scripting (XSS) vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to inject arbitrary web script or HTML via the (1) view, (2) id, CVE-2014-9146 · Other software · Fiyo · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to inject arbitrary web script or HTML via the (1) view, (2) id, (3) page, or (4) app parameter to the default URI or the (5) act parameter to dapur/index.php.
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Apr 14, 2015Multiple SQL injection vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an edit action tCVE-2014-9145 · Other software · Fiyo · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an edit action to dapur/index.php; (2) cat, (3) user, or (4) level parameter to dapur/apps/app_article/controller/article_list.php; or (5) email parameter in an email action or (6) username parameter in a user action to dapur/apps/app_user/controller/check_user.php.
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jun 11, 2014Cross-site scripting (XSS) vulnerability in apps/app_comment/form_comment.php in Fiyo CMS 1.5.7 allows remote attackers to inject arbitrary web script or HTML vCVE-2014-4032 · Other software · Fiyo · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in apps/app_comment/form_comment.php in Fiyo CMS 1.5.7 allows remote attackers to inject arbitrary web script or HTML via the Nama field.
- Product
- Fiyo CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.