Vulnerabilities > Fiyo > Fiyo CMS > Critical

DATE CVE VULNERABILITY TITLE RISK
2017-11-21 CVE-2015-3934 SQL Injection vulnerability in Fiyo CMS 2.0.1.9.1
Multiple SQL injection vulnerabilities in Fiyo CMS 2.0_1.9.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to apps/app_article/controller/rating.php or (2) user parameter to user/login.
network
low complexity
fiyo CWE-89
critical
 9.8
9.8
2017-10-16 CVE-2014-9148 Improper Access Control vulnerability in Fiyo CMS
Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super administrator function via the view parameter in a direct request to fiyo/dapur.
network
low complexity
fiyo CWE-284
critical
 9.8
9.8
2017-07-26 CVE-2017-11631 SQL Injection vulnerability in Fiyo CMS 2.0.7
dapur/app/app_user/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter.
network
low complexity
fiyo CWE-89
critical
 9.8
9.8
2017-07-18 CVE-2017-11412 SQL Injection vulnerability in Fiyo CMS 2.0.7
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/controller/comment_status.php via $_GET['id'].
network
low complexity
fiyo CWE-89
critical
 9.8
9.8
2017-07-18 CVE-2017-11413 SQL Injection vulnerability in Fiyo CMS 2.0.7
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/comment_status.php via $_GET['id'].
network
low complexity
fiyo CWE-89
critical
 9.8
9.8
2017-07-18 CVE-2017-11414 SQL Injection vulnerability in Fiyo CMS 2.0.7
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/sys_comment.php via $_POST['comment'], $_POST['name'], $_POST['web'], $_POST['email'], $_POST['status'], $_POST['id'], and $_REQUEST['id'].
network
low complexity
fiyo CWE-89
critical
 9.8
9.8
2017-07-18 CVE-2017-11415 SQL Injection vulnerability in Fiyo CMS 2.0.7
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/sys_article.php via $_POST['parent_id'], $_POST['desc'], $_POST['keys'], and $_POST['level'].
network
low complexity
fiyo CWE-89
critical
 9.8
9.8
2017-07-18 CVE-2017-11416 SQL Injection vulnerability in Fiyo CMS 2.0.7
Fiyo CMS 2.0.7 has SQL injection in /apps/app_comment/controller/insert.php via the name parameter.
network
low complexity
fiyo CWE-89
critical
 9.8
9.8
2017-07-18 CVE-2017-11417 SQL Injection vulnerability in Fiyo CMS 2.0.7
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_status.php via $_GET['id'].
network
low complexity
fiyo CWE-89
critical
 9.8
9.8
2017-07-18 CVE-2017-11418 SQL Injection vulnerability in Fiyo CMS 2.0.7
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_list.php via $_GET['cat'], $_GET['user'], $_GET['level'], and $_GET['iSortCol_'.$i].
network
low complexity
fiyo CWE-89
critical
 9.8
9.8