CVE-2017-10968

In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "<?php" in a route=template request.

• CWE-94

• http://www.yuesec.com/img/cccccve/finecms_codeexec/finecmscodeexec_2017_07_06_submit.htmlExploit, Mitigation, Third Party Advisory
• http://www.yuesec.com/img/cccccve/finecms_codeexec/finecmscodeexec_2017_07_06_submit.htmlExploit, Mitigation, Third Party Advisory

Published

Jul 7, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-10961REDCap before 7.5.1 has CSRF in the deletion feature of the …
• CVE-2017-10962REDCap before 7.5.1 has XSS via the query string.
• CVE-2017-10963In Knox SDS IAM (Identity Access Management) and EMM (Enterp…
• CVE-2017-10965An issue was discovered in Irssi before 1.0.4. When receivin…
• CVE-2017-10966An issue was discovered in Irssi before 1.0.4. While updatin…
• CVE-2017-10967In FineCMS before 2017-07-06, application\core\controller\co…
• CVE-2017-1097IBM Emptoris Strategic Supply Management Platform 10.0.0.x t…
• CVE-2017-10970Cross-site scripting (XSS) vulnerability in link.php in Cact…
• CVE-2017-10971In the X.Org X server before 2017-06-19, a user authenticate…
• CVE-2017-10972Uninitialized data in endianness conversion in the XEvent ha…
• CVE-2017-10973In FineCMS before 2017-07-06, application/lib/ajax/get_image…
• CVE-2017-10974Yaws 1.91 allows Unauthenticated Remote File Disclosure via …