Hongcms Project Hongcms
20 CVEs affecting Hongcms Project Hongcms. Latest disclosed: 2023-06-20. Critical: 1, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-18178 | Critical | 9.8 | 2021-05-18 | Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/ind… |
CVE-2020-21252 | High | 8.8 | 2023-06-20 | Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges via the updateusers… |
CVE-2018-10265 | High | 8.8 | 2018-04-22 | An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI. |
CVE-2022-28523 | High | 8.1 | 2022-04-26 | HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete. |
CVE-2018-16774 | High | 7.5 | 2018-09-10 | HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete. |
CVE-2022-32412 | High | 7.2 | 2022-07-01 | An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell. |
CVE-2022-32411 | High | 7.2 | 2022-07-01 | An issue in the languages config file of HongCMS v3.0 allows attackers to getshell. |
CVE-2018-13021 | High | 7.2 | 2018-06-29 | An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template… |
CVE-2018-12912 | High | 7.2 | 2018-06-27 | An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbac… |
CVE-2020-21431 | Medium | 6.5 | 2021-10-04 | HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit. |
CVE-2019-16867 | Medium | 6.5 | 2019-09-25 | HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774… |
CVE-2019-8407 | Medium | 6.5 | 2019-02-17 | HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI. |
CVE-2020-21643 | Medium | 6.1 | 2023-04-28 | Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop. |
CVE-2019-17611 | Medium | 6.1 | 2019-10-16 | HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter. |
CVE-2019-17610 | Medium | 6.1 | 2019-10-16 | HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter. |
CVE-2019-17609 | Medium | 6.1 | 2019-10-16 | HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter. |
CVE-2019-17608 | Medium | 6.1 | 2019-10-16 | HongCMS 3.0.0 has XSS via the install/index.php dbname parameter. |
CVE-2019-17607 | Medium | 6.1 | 2019-10-16 | HongCMS 3.0.0 has XSS via the install/index.php servername parameter. |
CVE-2018-12266 | Medium | 6.1 | 2018-06-13 | system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code. |
CVE-2018-10422 | Medium | 4.8 | 2018-04-26 | An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field. |