Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: Sitejo Clear all filters
TI-2018-15616 CVE-2018-25391 · GHSA-jv33-m8x5-6599

HaPe PKH 1.1 Missing Authorization Allows Unauthenticated Record Deletion

Priority HIGH 77

HaPe PKH 1.1 fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to delete arbitrary records by sending a crafted request that specifies the target record's id.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00332 Published 2026-05-29 No fix listed CWE-862
TI-2018-15615 CVE-2018-25390 · GHSA-4233-hhxh-5hm7

HaPe PKH 1.1 SQL Injection via desa Parameter

Priority HIGH 77

HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'desa' POST parameter sent to lap-peserta-perdesa-pdf.php.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00334 Published 2026-05-29 No fix listed CWE-89
TI-2018-15614 CVE-2018-25389 · GHSA-j6xx-7gg4-8rw9

HaPe PKH 1.1 SQL Injection via nama_kelompok Parameter

Priority HIGH 77

HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'nama_kelompok' POST parameter sent to lap-anggota-kelompok-pdf.…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00334 Published 2026-05-29 No fix listed CWE-89
TI-2018-15613 CVE-2018-25388 · GHSA-vrwp-pc3f-v22w

HaPe PKH 1.1 Arbitrary File Upload via aksi_foto.php

Priority HIGH 73

HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by bypassing file type validation.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00519 Published 2026-05-29 No fix listed CWE-434
TI-2018-15612 CVE-2018-25387 · GHSA-4j94-652m-g385

HaPe PKH 1.1 Cross-Site Request Forgery via aksi_user.php

Priority HIGH 70

HaPe PKH 1.1 contains a cross-site request forgery vulnerability that allows attackers to change administrator passwords by submitting forged requests to the user update endpoint.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00175 Published 2026-05-29 No fix listed CWE-352
TI-2018-15611 CVE-2018-25386 · GHSA-86v9-rw4q-v83j

HaPe PKH 1.1 SQL Injection via id Parameter in admin/media.php

Priority HIGH 77

HaPe PKH 1.1 contains multiple SQL injection vulnerabilities in admin/media.php that allow attackers to manipulate database queries by injecting SQL code through the 'id' parameter.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00334 Published 2026-05-29 No fix listed CWE-89