Vulnerabilities

HongCMS Project HongCMS 3.0.0

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

19CVEs

CVE-2018-13021

An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI.

Published 2018-06-29 · Modified

9.0EPSS 0.022

CVE-2018-10265

An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI.

Published 2018-04-21 · Modified

8.8EPSS 0.005

CVE-2020-21252

Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges via the updateusers parameter.

Published 2023-06-20 · Modified

8.8EPSS 0.004

CVE-2022-28523

HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete.

Published 2022-04-26 · Modified

8.1EPSS 0.011

CVE-2018-16774

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete.

Published 2018-09-10 · Modified

7.5EPSS 0.016

CVE-2018-12912

An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI.

Published 2018-06-27 · Modified

7.21 PoCEPSS 0.026

CVE-2022-32412

An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell.

Published 2022-07-01 · Modified

7.2EPSS 0.009

CVE-2022-32411

An issue in the languages config file of HongCMS v3.0 allows attackers to getshell.

Published 2022-07-01 · Modified

7.2EPSS 0.009

CVE-2019-8407

HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI.

Published 2019-02-17 · Modified

6.5EPSS 0.015

CVE-2019-16867

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. (If the attacker deletes config.php and visits install/index.php, they can reinstall the product.)

Published 2019-09-25 · Modified

6.5EPSS 0.011

CVE-2020-21431

HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit.

Published 2021-10-04 · Modified

6.5EPSS 0.009

CVE-2019-17609

HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter.

Published 2019-10-16 · Modified

6.1EPSS 0.010

CVE-2019-17611

HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter.