Vendors / Hoosk Records 14 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 4
CVSS high 1
Exploited now Hoosk records in CISA KEV No Hoosk vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
An arbitrary file upload vulnerability in the /attachments component of Hoosk v1.8 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01041 · Published 2022-11-16 · No fix listed CWE-434
Priority MEDIUM 60
Cross Site Scripting vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00281 · Published 2025-02-14 · No fix listed CWE-79
Priority MEDIUM 58
SQL Injection vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component.
CVSS 3.1 MEDIUM 5.1· Local · No auth · No interaction · EPSS 0.00258 · Published 2025-02-14 · No fix listed CWE-89
Priority MEDIUM 55
Cross Site Scripting vulnerability in hooskcms v.1.8 allows a remote attacker to cause a denial of service via the custom Link title parameter and the Title parameter.
CVSS 3.1 MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00269 · Published 2025-02-14 · No fix listed CWE-79
Priority MEDIUM 47
An issue was discovered in Hoosk CmS v1.8.0.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02756 · Published 2020-09-29 · No fix listed
Priority MEDIUM 47
Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0267 · Published 2018-09-10 · No fix listed CWE-94
Priority MEDIUM 44
An issue was discovered in Hoosk CMS v1.8.0.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01159 · Published 2020-09-29 · No fix listed CWE-89
Priority LOW 39
CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulting in account creation.
CVSS 3.0 HIGH 8.8· Network · No auth · User interaction · EPSS 0.0058 · Published 2018-03-01 · No fix listed CWE-352
Priority LOW 30
An issue Hoosk v1.7.1 allows a remote attacker to execute arbitrary code via a crafted script to the config.php component.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00614 · Published 2024-11-08 · No fix listed CWE-79
Priority LOW 28
XSS in edit page of Hoosk 1.8.0 allows attacker to execute javascript code in user browser via edit page with XSS payload bypass filter some special chars.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00657 · Published 2022-04-25 · No fix listed CWE-79
Priority LOW 28
An issue was discovered in Hoosk CMS v1.8.0.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.007 · Published 2020-09-29 · No fix listed CWE-79
Priority LOW 26
A vulnerability exists in Hoosk 1.8.0 in /install/index.php, due to a failure to check if config.php already exists in the root directory, which could let a malicious user reinstall the website.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00799 · Published 2022-03-31 · No fix listed
Priority LOW 23
Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new.
CVSS 3.0 MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.0067 · Published 2018-09-10 · No fix listed CWE-79
Priority LOW 20
Hoosk Codeigniter CMS before 1.7.2 is affected by a Cross Site Request Forgery (CSRF).
CVSS 3.1 MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00373 · Published 2020-08-28 · No fix listed CWE-352
Open these records in search → All records by CVSS severity
4 1 9 0 0
THREATIST.IORead the docs