Filtered by vendor Hongcms Project Subscriptions

Search

Switch to Advanced Search (Beta)
Total 20 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-21643 1 Hongcms Project 1 Hongcms 2025-01-31 6.1 Medium
Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop.
CVE-2020-21252 1 Hongcms Project 1 Hongcms 2024-12-10 8.8 High
Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges via the updateusers parameter.
CVE-2022-32412 1 Hongcms Project 1 Hongcms 2024-11-21 7.2 High
An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell.
CVE-2022-32411 1 Hongcms Project 1 Hongcms 2024-11-21 7.2 High
An issue in the languages config file of HongCMS v3.0 allows attackers to getshell.
CVE-2022-28523 1 Hongcms Project 1 Hongcms 2024-11-21 8.1 High
HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete.
CVE-2020-21431 1 Hongcms Project 1 Hongcms 2024-11-21 6.5 Medium
HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit.
CVE-2020-18178 1 Hongcms Project 1 Hongcms 2024-11-21 9.8 Critical
Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax."
CVE-2019-8407 1 Hongcms Project 1 Hongcms 2024-11-21 N/A
HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI.
CVE-2019-17611 1 Hongcms Project 1 Hongcms 2024-11-21 6.1 Medium
HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter.
CVE-2019-17610 1 Hongcms Project 1 Hongcms 2024-11-21 6.1 Medium
HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter.
CVE-2019-17609 1 Hongcms Project 1 Hongcms 2024-11-21 6.1 Medium
HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter.
CVE-2019-17608 1 Hongcms Project 1 Hongcms 2024-11-21 6.1 Medium
HongCMS 3.0.0 has XSS via the install/index.php dbname parameter.
CVE-2019-17607 1 Hongcms Project 1 Hongcms 2024-11-21 6.1 Medium
HongCMS 3.0.0 has XSS via the install/index.php servername parameter.
CVE-2019-16867 1 Hongcms Project 1 Hongcms 2024-11-21 6.5 Medium
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. (If the attacker deletes config.php and visits install/index.php, they can reinstall the product.)
CVE-2018-16774 1 Hongcms Project 1 Hongcms 2024-11-21 N/A
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete.
CVE-2018-13021 1 Hongcms Project 1 Hongcms 2024-11-21 N/A
An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI.
CVE-2018-12912 1 Hongcms Project 1 Hongcms 2024-11-21 N/A
An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI.
CVE-2018-12266 1 Hongcms Project 1 Hongcms 2024-11-21 N/A
system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code.
CVE-2018-10422 1 Hongcms Project 1 Hongcms 2024-11-21 N/A
An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field.
CVE-2018-10265 1 Hongcms Project 1 Hongcms 2024-11-21 N/A
An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI.