Hongcms
CVEs (20)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-18178 | Cri | 0.64 | 9.8 | 0.02 | May 18, 2021 | Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax." | ||
| CVE-2020-21252 | Hig | 0.57 | 8.8 | 0.00 | Jun 20, 2023 | Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges via the updateusers parameter. | ||
| CVE-2018-10265 | Hig | 0.57 | 8.8 | 0.00 | Apr 22, 2018 | An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI. | ||
| CVE-2022-28523 | Hig | 0.53 | 8.1 | 0.01 | Apr 26, 2022 | HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete. | ||
| CVE-2018-12912 | Hig | 0.50 | 7.2 | 0.03 | Jun 27, 2018 | An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI. | ||
| CVE-2018-16774 | Hig | 0.49 | 7.5 | 0.02 | Sep 10, 2018 | HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete. | ||
| CVE-2022-32412 | Hig | 0.47 | 7.2 | 0.01 | Jul 1, 2022 | An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell. | ||
| CVE-2022-32411 | Hig | 0.47 | 7.2 | 0.01 | Jul 1, 2022 | An issue in the languages config file of HongCMS v3.0 allows attackers to getshell. | ||
| CVE-2018-13021 | Hig | 0.47 | 7.2 | 0.02 | Jun 29, 2018 | An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI. | ||
| CVE-2020-21431 | Med | 0.42 | 6.5 | 0.01 | Oct 4, 2021 | HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit. | ||
| CVE-2019-16867 | Med | 0.42 | 6.5 | 0.01 | Sep 25, 2019 | HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. (If the attacker deletes config.php and visits install/index.php, they can reinstall the product.) | ||
| CVE-2019-8407 | Med | 0.42 | 6.5 | 0.01 | Feb 17, 2019 | HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI. | ||
| CVE-2020-21643 | Med | 0.40 | 6.1 | 0.00 | Apr 28, 2023 | Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop. | ||
| CVE-2019-17611 | Med | 0.40 | 6.1 | 0.01 | Oct 16, 2019 | HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter. | ||
| CVE-2019-17610 | Med | 0.40 | 6.1 | 0.01 | Oct 16, 2019 | HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter. | ||
| CVE-2019-17609 | Med | 0.40 | 6.1 | 0.01 | Oct 16, 2019 | HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter. | ||
| CVE-2019-17608 | Med | 0.40 | 6.1 | 0.01 | Oct 16, 2019 | HongCMS 3.0.0 has XSS via the install/index.php dbname parameter. | ||
| CVE-2019-17607 | Med | 0.40 | 6.1 | 0.01 | Oct 16, 2019 | HongCMS 3.0.0 has XSS via the install/index.php servername parameter. | ||
| CVE-2018-12266 | Med | 0.40 | 6.1 | 0.01 | Jun 13, 2018 | system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code. | ||
| CVE-2018-10422 | Med | 0.31 | 4.8 | 0.01 | Apr 26, 2018 | An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field. |
- risk 0.64cvss 9.8epss 0.02
Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax."
- risk 0.57cvss 8.8epss 0.00
Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges via the updateusers parameter.
- risk 0.57cvss 8.8epss 0.00
An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI.
- risk 0.53cvss 8.1epss 0.01
HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete.
- risk 0.50cvss 7.2epss 0.03
An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI.
- risk 0.49cvss 7.5epss 0.02
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete.
- risk 0.47cvss 7.2epss 0.01
An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell.
- risk 0.47cvss 7.2epss 0.01
An issue in the languages config file of HongCMS v3.0 allows attackers to getshell.
- risk 0.47cvss 7.2epss 0.02
An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI.
- risk 0.42cvss 6.5epss 0.01
HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit.
- risk 0.42cvss 6.5epss 0.01
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. (If the attacker deletes config.php and visits install/index.php, they can reinstall the product.)
- risk 0.42cvss 6.5epss 0.01
HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI.
- risk 0.40cvss 6.1epss 0.00
Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop.
- risk 0.40cvss 6.1epss 0.01
HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter.
- risk 0.40cvss 6.1epss 0.01
HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter.
- risk 0.40cvss 6.1epss 0.01
HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter.
- risk 0.40cvss 6.1epss 0.01
HongCMS 3.0.0 has XSS via the install/index.php dbname parameter.
- risk 0.40cvss 6.1epss 0.01
HongCMS 3.0.0 has XSS via the install/index.php servername parameter.
- risk 0.40cvss 6.1epss 0.01
system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code.
- risk 0.31cvss 4.8epss 0.01
An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field.