Critical severity9.8NVD Advisory· Published Oct 16, 2017· Updated Jun 17, 2026

CVE-2014-9148

Description

Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super administrator function via the view parameter in a direct request to fiyo/dapur.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Fiyo/FiyoCMS2 versions
cpe:2.3:a:fiyo:fiyo_cms:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:fiyo:fiyo_cms:*:*:*:*:*:*:*:*range: <=2.0.1.8
- (no CPE)range: = 2.0.1.8

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/131165/FiyoCMS-2.0.1.8-XSS-SQL-Injection-URL-Bypass.htmlnvdExploitIssue TrackingThird Party AdvisoryVDB Entry
www.exploit-db.com/exploits/36581/nvdExploitIssue TrackingThird Party AdvisoryVDB Entry
www.securityfocus.com/bid/73437nvdThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.009
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000