CVE-2017-8853

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Fiyo CMS v2.0.7 has an arbitrary file delete vulnerability in dapur/apps/app_config/controller/backuper.php via directory traversal in the file parameter during an act=db action.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/FiyoCMS/FiyoCMS/issues/2Issue Tracking, Patch, Third Party Advisory
https://github.com/FiyoCMS/FiyoCMS/issues/2Issue Tracking, Patch, Third Party Advisory

Timeline

Published: May 9, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-88547.8wolfSSL before 3.10.2 has an out-of-bounds memory access with loading crafted DH parameters, aka a buffer overflow triggered by a malformed CVE-2017-88557.5wolfSSL before 3.11.0 does not prevent wc_DhAgree from accepting a malformed DH key.CVE-2017-88569.8In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated, arbitrary remote command execution u CVE-2017-88579.8In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated file copy and arbitrary remote comman CVE-2017-88589.8In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated privileged remote file write using th CVE-2017-88599.8In Veritas NetBackup Appliance 3.0 and earlier, unauthenticated users can execute arbitrary commands as root.CVE-2017-88606.5Information disclosure through directory listing on the Cohu 3960HD allows an attacker to view and download source code, log files, and othe CVE-2017-88619.8Missing authentication for the remote configuration port 1236/tcp on the Cohu 3960HD allows an attacker to change configuration parameters s CVE-2017-88629.8The webupgrade function on the Cohu 3960HD does not verify the firmware upgrade files or process, allowing an attacker to upload a specially CVE-2017-88637.5Information disclosure of .esp source code on the Cohu 3960 allows an attacker to view sensitive information such as application logic with CVE-2017-88649.8Client-side enforcement using JavaScript of server-side security options on the Cohu 3960HD allows an attacker to manipulate options sent to CVE-2017-88655.9Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 do not provide sufficient protections against capture-replay att