CVE-2020-21643

Cross Site Scripting XSS vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop...

Cross site scripting

Cross Site Scripting XSS vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop...

CVE-2020-21643

HongCMS 3.0 is affected by a Cross Site Scripting (XSS) vulnerability that allows an attacker to run arbitrary code via the callback parameter to /ajax/myshop. Affected component: HongCMS 3.0; root cause: unsanitized callback parameter in the /ajax/myshop endpoint. Impact per sources: XSS with po...

CVE-2020-21643

Cross Site Scripting XSS vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop...

CVE-2020-21643

Cross Site Scripting XSS vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop...

PT-2023-11595 · Hongcms · Hongcms

Name of the Vulnerable Software and Affected Versions: HongCMS version 3.0 Description: The issue allows attackers to run arbitrary code via the callback parameter to the "/ajax/myshop" API endpoint. This enables attackers to execute malicious scripts, potentially leading to unauthorized access o...

HongCMS 跨站脚本漏洞

HongCMS is an open source lightweight content management system CMS. A cross-site scripting vulnerability exists in HongCMS version 3.0, which originates from running arbitrary code via the callback parameter of /ajax/myshop. An attacker can exploit this vulnerability to perform a cross-site...

CVE-2020-21643: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop...

CVE-2022-32411

An issue in the languages config file of HongCMS v3.0 allows attackers to getshell...

CVE-2022-32412

An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell...

CVE-2022-32411

An issue in the languages config file of HongCMS v3.0 allows attackers to getshell...

CVE-2022-32412

An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell...

CVE-2022-32412

An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell...

CVE-2022-32411

An issue in the languages config file of HongCMS v3.0 allows attackers to getshell...

Code injection

An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell...

Denial of service

An issue in the languages config file of HongCMS v3.0 allows attackers to getshell...

CVE-2022-32412

CVE-2022-32412 affects HongCMS v3.0. The issue resides in the "/template/edit" component, described as allowing attackers to get shell access. The available connected sources consistently reference a remote-code-execution/getshell impact via that component, with no publicly disclosed exploit deta...

CVE-2022-32412

An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell...

CVE-2022-32411

An issue in the languages config file of HongCMS v3.0 allows attackers to getshell...

CVE-2022-32411

The CVE-2022-32411 issue affects HongCMS v3.0, arising from a flaw in the languages configuration file that can allow an attacker to obtain a shell. The available connected documents consistently associate this vulnerability with HongCMS v3.0 and describe the impact as shell access, but they do n...