Vulnerabilities

Filters

1 selected

20 records

Sort

Vendor: Hongcms Project Clear all filters

TI-2020-14023 CVE-2020-21252 · GHSA-95vj-3rv6-35hp

Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker…

HIGH 73

Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges via the updateusers parameter.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00429 Published 2023-06-20 No fix listed CWE-352

TI-2020-14121 CVE-2020-21643 · GHSA-rgcf-fv23-mh6f

Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary…

MEDIUM 60

Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00406 Published 2023-04-28 No fix listed CWE-79

TI-2022-14089 CVE-2022-32412 · GHSA-9493-q4p5-ff5v

An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell.

LOW 33

An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0093 Published 2022-07-01 No fix listed

TI-2022-14088 CVE-2022-32411 · GHSA-hg6q-c3g8-36q3

An issue in the languages config file of HongCMS v3.0 allows attackers to getshell.

LOW 33

An issue in the languages config file of HongCMS v3.0 allows attackers to getshell.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0093 Published 2022-07-01 No fix listed

TI-2022-11213 CVE-2022-28523 · GHSA-9j5j-gv7x-3rjf

HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete.

LOW 37

HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01076 Published 2022-04-26 No fix listed CWE-22

TI-2020-14053 CVE-2020-21431 · GHSA-hp63-x8c8-jq88

HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit.

LOW 31

HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.0094 Published 2021-10-04 No fix listed

TI-2020-13340 CVE-2020-18178 · GHSA-7hqp-x3x5-hp75

Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete…

MEDIUM 46

Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax."

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01745 Published 2021-05-18 No fix listed CWE-22

TI-2019-13146 CVE-2019-17611 · GHSA-537v-2h27-7wg8

HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter.

LOW 29

HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01029 Published 2019-10-16 No fix listed CWE-79

TI-2019-13145 CVE-2019-17610 · GHSA-qhj8-v7h4-rpp7

HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter.

LOW 29

HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01029 Published 2019-10-16 No fix listed CWE-79

TI-2019-13144 CVE-2019-17609 · GHSA-wgrw-7gxq-9x5r

HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter.

LOW 29

HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01029 Published 2019-10-16 No fix listed CWE-79

TI-2019-13143 CVE-2019-17608 · GHSA-6wg4-5mx4-ch38

HongCMS 3.0.0 has XSS via the install/index.php dbname parameter.

LOW 29

HongCMS 3.0.0 has XSS via the install/index.php dbname parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01029 Published 2019-10-16 No fix listed CWE-79

TI-2019-13142 CVE-2019-17607 · GHSA-w3p7-69mc-wjf6

HongCMS 3.0.0 has XSS via the install/index.php servername parameter.

LOW 29

HongCMS 3.0.0 has XSS via the install/index.php servername parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01029 Published 2019-10-16 No fix listed CWE-79

TI-2019-12577 CVE-2019-16867 · GHSA-mqf2-454q-xwxp

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to…

LOW 31

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01116 Published 2019-09-25 No fix listed CWE-22

TI-2019-06032 CVE-2019-8407 · GHSA-8fj7-f6jq-9qw4

HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename…

LOW 32

HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI.

CVSS 3.0MEDIUM 6.5 Network High privileges No interaction EPSS 0.0145 Published 2019-02-17 No fix listed CWE-22

TI-2018-12011 CVE-2018-16774 · GHSA-q5mr-4xmm-w48x

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to…

LOW 36

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01619 Published 2018-09-10 No fix listed CWE-22

TI-2018-09344 CVE-2018-13021 · GHSA-jx5q-p685-xrcc

An issue was discovered in HongCMS 3.0.0.

LOW 36

An issue was discovered in HongCMS 3.0.0.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.0217 Published 2018-06-29 No fix listed CWE-434

TI-2018-09277 CVE-2018-12912 · GHSA-6hr4-77vc-5v97

An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0.

LOW 36

An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.02555 Published 2018-06-27 No fix listed CWE-89

TI-2018-08801 CVE-2018-12266 · GHSA-gpg4-32f3-j9f3

system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code.

LOW 28

system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00696 Published 2018-06-13 No fix listed CWE-79

TI-2018-07366 CVE-2018-10422 · GHSA-wjqf-4978-p4f6

An issue was discovered in HongCMS 3.0.0.

LOW 23

An issue was discovered in HongCMS 3.0.0.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00516 Published 2018-04-26 No fix listed CWE-79

TI-2018-07283 CVE-2018-10265 · GHSA-gfxr-3phg-gg9c

An issue was discovered in HongCMS v3.0.0.

LOW 38

An issue was discovered in HongCMS v3.0.0.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00449 Published 2018-04-21 No fix listed CWE-352