Vendors / hisiphp Records 6 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 3
Exploited now hisiphp records in CISA KEV No hisiphp vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 52
An issue in hisiphp v2.0.111 allows a remote attacker to execute arbitrary code via a crafted script to the SystemPlugins::mkInfo parameter in the SystemPlugins.php component.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01349 · Published 2024-04-29 · No fix listed CWE-94
Priority LOW 39
HisiPHP 1.0.8 allows CSRF via admin.php/admin/user/adduser.html to add an administrator account.
CVSS 3.0 HIGH 8.8· Network · No auth · User interaction · EPSS 0.00494 · Published 2018-10-01 · No fix listed CWE-352
Priority LOW 36
An Access Control vulnerability exists in HisiPHP 2.0.11 via special packets that are constructed in $files = Dir::getList($decompath.
CVSS 3.1 HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02568 · Published 2022-04-04 · No fix listed CWE-434
Priority LOW 35
HisiPHP 1.0.8 allows remote attackers to execute arbitrary PHP code by editing a plugin's name to contain that code.
CVSS 3.0 HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01437 · Published 2018-10-01 · No fix listed CWE-94
Priority LOW 29
Cross Site Scripting (XSS) vulnerability in HisiPHP 2.0.8 via the group name in addgroup.html.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00782 · Published 2021-06-21 · No fix listed CWE-79
Priority LOW 29
hisiphp 1.0.8 is affected by: Cross Site Scripting (XSS).
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00865 · Published 2019-07-24 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
1 3 2 0 0
THREATIST.IORead the docs