CVE-2018-12266

system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code...

CVE-2018-12266

system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code...

CVE-2018-12266

CVE-2018-12266 affects HongCMS 3.0.0, with a cross-site scripting vulnerability in system\errors\404.php triggered by crafted input that leads to a 404 response. Public sources (NVD/CNVD) describe an XSS flaw in this page; no patch/version details are provided in the supplied documents. The root ...

CVE-2018-12266: Improper Neutralization of Input During Web Page Generation

system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code...

PT-2018-11089

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue concerns a problem where crafted input can trigger a 404 HTTP status code, leading to XSS in the system/errors/404.php file of HongCMS. Recommendations For HongCMS version 3.0.0, update the...

CVE-2018-10422

An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field...

Cross site scripting

An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field...

CVE-2018-10422

An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field...

CVE-2018-10422

An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field...

CVE-2018-10422

CVE-2018-10422 : Multiple connected sources confirm a Stored Cross-Site Scripting vulnerability in HongCMS 3.0.0, specifically in the post news feature via the content field. The root cause is a lack of input sanitization/escaping in content handling, allowing arbitrary script/html injection. Aff...

HongCMS Cross-Site Scripting Vulnerability

HongCMS is an open source lightweight content management system CMS. A cross-site scripting vulnerability exists in the Add News feature in HongCMS version 3.0.0. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of a content field...

CVE-2018-10422: Improper Neutralization of Input During Web Page Generation

An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field...

PT-2018-9875

Name of the Vulnerable Software and Affected Versions: HongCMS version 3.0.0 Description: An issue was discovered in the post news feature, which has Stored XSS via the content field. Recommendations: For HongCMS version 3.0.0, update to a newer version that contains a fix for this issue, or as a...

HongCMS Cross-Site Request Forgery Vulnerability

HongCMS is an open source lightweight content management system CMS. A cross-site request forgery vulnerability exists in HongCMS version 3.0.0. A remote attacker can exploit this vulnerability to add an administrator account with the help of admin/index.php/users/save URI...

CVE-2018-10265

An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI...

CVE-2018-10265

An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI...

Cross site request forgery (csrf)

An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI...

CVE-2018-10265

An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI...

CVE-2018-10265

This CVE (CVE-2018-10265) affects HongCMS v3.0.0 and is a CSRF flaw on the admin/users/save endpoint that can add an administrator account. Root cause: CSRF protections not adequately enforced on the admin path. Impact (per provided metrics): CVSSv3 base score 8.8 (HIGH), with network attack vect...

CVE-2018-10265: Cross-Site Request Forgery (CSRF)

An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI...