Browse CVEs

HIGH 8.8 CVE-2020-21252 Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges via the up… Hongcms No fix yet Fix from $1,9502023-06-20 MEDIUM 6.1 CVE-2020-21643 Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop. Hongcms No fix yet Fix from $1,6002023-04-28 HIGH 7.2 CVE-2022-32411 An issue in the languages config file of HongCMS v3.0 allows attackers to getshell. Hongcms No fix yet Fix from $1,9502022-07-01 HIGH 7.2 CVE-2022-32412 An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell. Hongcms No fix yet Fix from $1,9502022-07-01 HIGH 8.1 CVE-2022-28523 HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete. Hongcms No fix yet Fix from $1,9502022-04-26 MEDIUM 6.5 CVE-2020-21431 HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit. Hongcms No fix yet Fix from $1,6002021-10-04 CRITICAL 9.8 CVE-2020-18178 Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms… Hongcms No fix yet Fix from $2,3002021-05-18 MEDIUM 6.1 CVE-2019-17607 HongCMS 3.0.0 has XSS via the install/index.php servername parameter. Hongcms No fix yet Fix from $1,6002019-10-16 MEDIUM 6.1 CVE-2019-17608 HongCMS 3.0.0 has XSS via the install/index.php dbname parameter. Hongcms No fix yet Fix from $1,6002019-10-16 MEDIUM 6.1 CVE-2019-17609 HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter. Hongcms No fix yet Fix from $1,6002019-10-16 MEDIUM 6.1 CVE-2019-17610 HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter. Hongcms No fix yet Fix from $1,6002019-10-16 MEDIUM 6.1 CVE-2019-17611 HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter. Hongcms No fix yet Fix from $1,6002019-10-16 MEDIUM 6.5 CVE-2019-16867 HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2… Hongcms No fix yet Fix from $1,6002019-09-25 MEDIUM 6.5 CVE-2019-8407 HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI. Hongcms No fix yet Fix from $1,6002019-02-17 HIGH 7.5 CVE-2018-16774 HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete. Hongcms No fix yet Fix from $1,9502018-09-10 HIGH 7.2 CVE-2018-13021 An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.ph… Hongcms No fix yet Fix from $1,9502018-06-29 HIGH 7.2 CVE-2018-12912 An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/op… Hongcms No fix yet Fix from $1,9502018-06-27 MEDIUM 6.1 CVE-2018-12266 system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code. Hongcms No fix yet Fix from $1,6002018-06-13 HIGH 8.8 CVE-2018-10265 An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI. Hongcms Mitigation only Fix from $1,9502018-04-22