What’s Vulnerable › Vulnerabilities

CVE-2017-16920

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-11-21 · updated 2026-06-17

Description

v5/config/system.php in dayrui FineCms 5.2.0 has a default SYS_KEY value and does not require key regeneration for each installation, which allows remote attackers to upload arbitrary .php files via a member api swfupload action to index.php.

Affected products

• Finecms: 5.2.0

References

• https://gitee.com/dayrui/finecms/commit/ff4b7ad3c3fbd3245b3bb7bc774d20c9705d9882
• https://user-images.githubusercontent.com/31153532/33065202-21b536f2-cee3-11e7-997a-c7d4f1b00ca7.jpg
• https://gitee.com/dayrui/finecms/commit/ff4b7ad3c3fbd3245b3bb7bc774d20c9705d9882
• https://user-images.githubusercontent.com/31153532/33065202-21b536f2-cee3-11e7-997a-c7d4f1b00ca7.jpg

Get alerted when CVE-2017-16920 or the next vulnerability affects your stack