RSS   Podatności dla 'Hongcms'   RSS

2021-05-18
 
CVE-2020-18178

CWE-22
 
 
Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax."

 
2019-09-25
 
CVE-2019-16867

CWE-20
 
 
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. (If the attacker deletes config.php and visits install/index.php, they can reinstall the product.)

 
2019-02-17
 
CVE-2019-8407

CWE-22
 
 
HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI.

 
2018-09-10
 
CVE-2018-16774

CWE-22
 
 
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete.

 
2018-06-29
 
CVE-2018-13021

CWE-434
 
 
An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI.

 
2018-06-27
 
CVE-2018-12912

CWE-89
 
 
An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI.

 
2018-06-13
 
CVE-2018-12266

CWE-79
 
 
system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code.

 
2018-04-26
 
CVE-2018-10422

CWE-79
 
 
An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field.

 
2018-04-21
 
CVE-2018-10265

CWE-352
 
 
An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI.

 

Copyright 2024, cxsecurity.com

 

Back to Top