Vulnerabilities

TI-2025-04495 CVE-2025-5013 · GHSA-vrgv-fv58-v6jg

HkCms Search index.html cross site scripting

MEDIUM 57

A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00708 Published 2025-05-21 No fix listed CWE-79

TI-2025-19126 CVE-2025-25761 · GHSA-fp5j-q9fh-m8qx

HIGH 67

HkCms v2.3.2.240702 was discovered to contain an arbitrary file write vulnerability in the component Appcenter.php.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00423 Published 2025-02-27 No fix listed CWE-73

TI-2024-35272 CVE-2024-52677 · GHSA-j27h-7c89-c3c6

MEDIUM 50

HkCms <= v2.3.2.240702 is vulnerable to file upload in the getFileName method in /app/common/library/Upload.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00641 Published 2024-11-20 No fix listed CWE-434

TI-2023-21545 CVE-2023-40786 · GHSA-rqwx-9gx2-v9q4

MEDIUM 58

HKcms v2.3.0.230709 is vulnerable to Cross Site Scripting (XSS) allowing administrator cookies to be stolen.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00348 Published 2023-09-11 No fix listed CWE-79