Hongcms Project
Hongcms Project Hongcms: vulnerabilidades y CVE
Hongcms Project Hongcms tiene 20 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE20
Últimos 12 meses0
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2020-21252 | Alta (8.8) | 0.43% | — | 20 jun 2023 | Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges via the updateusers parameter. |
| CVE-2020-21643 | Media (6.1) | 0.41% | — | 28 abr 2023 | Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop. |
| CVE-2022-32412 | Alta (7.2) | 0.93% | — | 1 jul 2022 | An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell. |
| CVE-2022-32411 | Alta (7.2) | 0.93% | — | 1 jul 2022 | An issue in the languages config file of HongCMS v3.0 allows attackers to getshell. |
| CVE-2022-28523 | Alta (8.1) | 1.1% | — | 26 abr 2022 | HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete. |
| CVE-2020-21431 | Media (6.5) | 0.94% | — | 4 oct 2021 | HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit. |
| CVE-2020-18178 | Crítica (9.8) | 1.7% | — | 18 may 2021 | Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax." |
| CVE-2019-17611 | Media (6.1) | 1.0% | — | 16 oct 2019 | HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter. |
| CVE-2019-17610 | Media (6.1) | 1.0% | — | 16 oct 2019 | HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter. |
| CVE-2019-17609 | Media (6.1) | 1.0% | — | 16 oct 2019 | HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter. |
| CVE-2019-17608 | Media (6.1) | 1.0% | — | 16 oct 2019 | HongCMS 3.0.0 has XSS via the install/index.php dbname parameter. |
| CVE-2019-17607 | Media (6.1) | 1.0% | — | 16 oct 2019 | HongCMS 3.0.0 has XSS via the install/index.php servername parameter. |
| CVE-2019-16867 | Media (6.5) | 1.1% | — | 25 sept 2019 | HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. (If the attacker deletes config.php and visits… |
| CVE-2019-8407 | Media (6.5) | 1.5% | — | 17 feb 2019 | HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI. |
| CVE-2018-16774 | Alta (7.5) | 1.6% | — | 10 sept 2018 | HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete. |
| CVE-2018-13021 | Alta (7.2) | 2.2% | — | 29 jun 2018 | An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI. |
| CVE-2018-12912 | Alta (7.2) | 2.6% | — | 27 jun 2018 | An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI. |
| CVE-2018-12266 | Media (6.1) | 0.71% | — | 13 jun 2018 | system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code. |
| CVE-2018-10422 | Media (4.8) | 0.53% | — | 26 abr 2018 | An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field. |
| CVE-2018-10265 | Alta (8.8) | 0.45% | — | 22 abr 2018 | An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI. |