Total
18 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-32411 | 1 Hongcms Project | 1 Hongcms | 2022-07-13 | 6.5 MEDIUM | 7.2 HIGH |
| An issue in the languages config file of HongCMS v3.0 allows attackers to getshell. | |||||
| CVE-2022-32412 | 1 Hongcms Project | 1 Hongcms | 2022-07-13 | 6.5 MEDIUM | 7.2 HIGH |
| An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell. | |||||
| CVE-2022-28523 | 1 Hongcms Project | 1 Hongcms | 2022-05-05 | 5.5 MEDIUM | 8.1 HIGH |
| HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete. | |||||
| CVE-2020-21431 | 1 Hongcms Project | 1 Hongcms | 2021-10-13 | 5.5 MEDIUM | 6.5 MEDIUM |
| HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit. | |||||
| CVE-2019-16867 | 1 Hongcms Project | 1 Hongcms | 2021-07-21 | 5.5 MEDIUM | 6.5 MEDIUM |
| HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. (If the attacker deletes config.php and visits install/index.php, they can reinstall the product.) | |||||
| CVE-2020-18178 | 1 Hongcms Project | 1 Hongcms | 2021-05-24 | 7.5 HIGH | 9.8 CRITICAL |
| Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax." | |||||
| CVE-2019-17607 | 1 Hongcms Project | 1 Hongcms | 2019-10-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| HongCMS 3.0.0 has XSS via the install/index.php servername parameter. | |||||
| CVE-2019-17608 | 1 Hongcms Project | 1 Hongcms | 2019-10-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| HongCMS 3.0.0 has XSS via the install/index.php dbname parameter. | |||||
| CVE-2019-17609 | 1 Hongcms Project | 1 Hongcms | 2019-10-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter. | |||||
| CVE-2019-17610 | 1 Hongcms Project | 1 Hongcms | 2019-10-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter. | |||||
| CVE-2019-17611 | 1 Hongcms Project | 1 Hongcms | 2019-10-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter. | |||||
| CVE-2019-8407 | 1 Hongcms Project | 1 Hongcms | 2019-02-19 | 5.5 MEDIUM | 6.5 MEDIUM |
| HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI. | |||||
| CVE-2018-16774 | 1 Hongcms Project | 1 Hongcms | 2018-09-24 | 6.4 MEDIUM | 7.5 HIGH |
| HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete. | |||||
| CVE-2018-13021 | 1 Hongcms Project | 1 Hongcms | 2018-08-21 | 9.0 HIGH | 7.2 HIGH |
| An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI. | |||||
| CVE-2018-12912 | 1 Hongcms Project | 1 Hongcms | 2018-08-20 | 6.5 MEDIUM | 7.2 HIGH |
| An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI. | |||||
| CVE-2018-12266 | 1 Hongcms Project | 1 Hongcms | 2018-07-26 | 4.3 MEDIUM | 6.1 MEDIUM |
| system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code. | |||||
| CVE-2018-10265 | 1 Hongcms Project | 1 Hongcms | 2018-05-25 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI. | |||||
| CVE-2018-10422 | 1 Hongcms Project | 1 Hongcms | 2018-05-25 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field. | |||||