Hongcms Project

Records20All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

Hongcms Project records in CISA KEV

No Hongcms Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Hongcms 20 records HIGH

Records

20 records

TI-2020-14023 CVE-2020-21252 · GHSA-95vj-3rv6-35hp

Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker…

HIGH 73

Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges via the updateusers parameter.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00429 Published 2023-06-20 No fix listed CWE-352

TI-2020-14121 CVE-2020-21643 · GHSA-rgcf-fv23-mh6f

Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary…

MEDIUM 60

Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00406 Published 2023-04-28 No fix listed CWE-79

TI-2020-13340 CVE-2020-18178 · GHSA-7hqp-x3x5-hp75

Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete…

MEDIUM 46

Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax."

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01745 Published 2021-05-18 No fix listed CWE-22

TI-2018-07283 CVE-2018-10265 · GHSA-gfxr-3phg-gg9c

An issue was discovered in HongCMS v3.0.0.

LOW 38

An issue was discovered in HongCMS v3.0.0.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00449 Published 2018-04-21 No fix listed CWE-352

TI-2022-11213 CVE-2022-28523 · GHSA-9j5j-gv7x-3rjf

HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete.

LOW 37

HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01076 Published 2022-04-26 No fix listed CWE-22

TI-2018-12011 CVE-2018-16774 · GHSA-q5mr-4xmm-w48x

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to…

LOW 36

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01619 Published 2018-09-10 No fix listed CWE-22

TI-2018-09344 CVE-2018-13021 · GHSA-jx5q-p685-xrcc

An issue was discovered in HongCMS 3.0.0.

LOW 36

An issue was discovered in HongCMS 3.0.0.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.0217 Published 2018-06-29 No fix listed CWE-434

TI-2018-09277 CVE-2018-12912 · GHSA-6hr4-77vc-5v97

An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0.

LOW 36

An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.02555 Published 2018-06-27 No fix listed CWE-89

TI-2022-14089 CVE-2022-32412 · GHSA-9493-q4p5-ff5v

An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell.

LOW 33

An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0093 Published 2022-07-01 No fix listed

TI-2022-14088 CVE-2022-32411 · GHSA-hg6q-c3g8-36q3

An issue in the languages config file of HongCMS v3.0 allows attackers to getshell.

LOW 33

An issue in the languages config file of HongCMS v3.0 allows attackers to getshell.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0093 Published 2022-07-01 No fix listed

TI-2019-06032 CVE-2019-8407 · GHSA-8fj7-f6jq-9qw4

HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename…

LOW 32

HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI.

CVSS 3.0MEDIUM 6.5 Network High privileges No interaction EPSS 0.0145 Published 2019-02-17 No fix listed CWE-22

TI-2020-14053 CVE-2020-21431 · GHSA-hp63-x8c8-jq88

HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit.

LOW 31

HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.0094 Published 2021-10-04 No fix listed

TI-2019-12577 CVE-2019-16867 · GHSA-mqf2-454q-xwxp

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to…

LOW 31

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01116 Published 2019-09-25 No fix listed CWE-22

TI-2019-13146 CVE-2019-17611 · GHSA-537v-2h27-7wg8