Contec Conprosys_hmi_system
15 CVEs affecting Contec Conprosys_hmi_system. Latest disclosed: 2025-07-01. Critical: 1, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-44456 | Critical | 9.8 | 2022-12-19 | CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is… |
CVE-2023-28657 | High | 8.8 | 2023-06-01 | Improper access control vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user of the PC where the affected product is installed ma… |
CVE-2023-28713 | High | 8.1 | 2023-06-01 | Plaintext storage of a password exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. Because account information of the database is saved in a local f… |
CVE-2023-28399 | High | 7.8 | 2023-06-01 | Incorrect permission assignment for critical resource exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. ACL (Access Control List) is not appropriat… |
CVE-2025-34081 | High | 7.5 | 2025-07-01 | The Contec Co.,Ltd. CONPROSYS HMI System (CHS) exposes a PHP phpinfo() debug page to unauthenticated users that may contain sensitive data useful for an attack… |
CVE-2023-22339 | High | 7.5 | 2023-01-20 | Improper access control vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to bypass access restriction… |
CVE-2023-22331 | High | 7.5 | 2023-01-20 | Use of default credentials vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to alter user credentials… |
CVE-2023-29154 | High | 7.2 | 2023-06-01 | SQL injection vulnerability exists in the CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user who can access the affected product with an administrative… |
CVE-2023-22324 | Medium | 6.5 | 2023-01-30 | SQL injection vulnerability in the CONPROSYS HMI System (CHS) Ver.3.5.0 and earlier allows a remote authenticated attacker to execute an arbitrary SQL command… |
CVE-2025-34080 | Medium | 6.1 | 2025-07-01 | The Contec Co.,Ltd. CONPROSYS HMI System (CHS) is vulnerable to Cross-Site Scripting (XSS) in the getqsetting.php functionality that could allow reflected exec… |
CVE-2023-22373 | Medium | 5.4 | 2023-01-20 | Cross-site scripting vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote authenticated attacker to inject an arbitrary script and… |
CVE-2023-22334 | Medium | 5.3 | 2023-01-20 | Use of password hash instead of password for authentication vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote authenticated att… |
CVE-2023-28824 | Medium | 4.9 | 2023-06-01 | Server-side request forgery vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user who can access the affected product with an admi… |
CVE-2023-28651 | Medium | 4.8 | 2023-06-01 | Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. If a user who can access the affected product with an administ… |
CVE-2023-2758 | Low | 3.7 | 2023-05-31 | A denial of service vulnerability exists in Contec CONPROSYS HMI System versions 3.5.2 and prior. When there is a time-zone mismatch in certain configuration f… |