CVE-2017-11201

MEDIUM

Finecms - XSS

Title source: rule

Description

application/core/controller/images.php in FineCMS through 2017-07-12 allows remote authenticated admins to conduct XSS attacks by uploading an image via a route=images action.

References (1)

[Exploit, Third Party Advisory] http://lorexxar.cn/2017/07/11/Some%20Vulnerability%20for%20FineCMS%20through%202017.7.11/#Stored-XSS-in-images-php

Scores

CVSS v3 5.4

EPSS 0.0016

EPSS Percentile 36.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

finecms_project/finecms

n/a/n/a

Published Jul 13, 2017

Tracked Since Feb 18, 2026