Cross site scripting

Cross Site Scripting XSS vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop...

CVE-2020-21643

Cross Site Scripting XSS vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop...

PT-2023-11595 · Hongcms · Hongcms

Name of the Vulnerable Software and Affected Versions: HongCMS version 3.0 Description: The issue allows attackers to run arbitrary code via the callback parameter to the "/ajax/myshop" API endpoint. This enables attackers to execute malicious scripts, potentially leading to unauthorized access o...

CVE-2020-21643

Cross Site Scripting XSS vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop...

HongCMS 跨站脚本漏洞

HongCMS is an open source lightweight content management system CMS. A cross-site scripting vulnerability exists in HongCMS version 3.0, which originates from running arbitrary code via the callback parameter of /ajax/myshop. An attacker can exploit this vulnerability to perform a cross-site...

CVE-2020-21643

HongCMS 3.0 is affected by a Cross Site Scripting (XSS) vulnerability that allows an attacker to run arbitrary code via the callback parameter to /ajax/myshop. Affected component: HongCMS 3.0; root cause: unsanitized callback parameter in the /ajax/myshop endpoint. Impact per sources: XSS with po...

CVE-2022-32412

An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell...

CVE-2022-32411

An issue in the languages config file of HongCMS v3.0 allows attackers to getshell...

CVE-2022-32412

An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell...

CVE-2022-32412

An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell...

CVE-2022-32411

An issue in the languages config file of HongCMS v3.0 allows attackers to getshell...

CVE-2022-32411

An issue in the languages config file of HongCMS v3.0 allows attackers to getshell...

Denial of service

An issue in the languages config file of HongCMS v3.0 allows attackers to getshell...

Code injection

An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell...

CVE-2022-32412

An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell...

CVE-2022-32412

CVE-2022-32412 affects HongCMS v3.0. The issue resides in the "/template/edit" component, described as allowing attackers to get shell access. The available connected sources consistently reference a remote-code-execution/getshell impact via that component, with no publicly disclosed exploit deta...

CVE-2022-32411

The CVE-2022-32411 issue affects HongCMS v3.0, arising from a flaw in the languages configuration file that can allow an attacker to obtain a shell. The available connected documents consistently associate this vulnerability with HongCMS v3.0 and describe the impact as shell access, but they do n...

CVE-2022-32411

An issue in the languages config file of HongCMS v3.0 allows attackers to getshell...

HongCMS 安全漏洞

HongCMS is an open source lightweight content management system CMS. A security vulnerability exists in HongCMS v3.0 that stems from an issue in the language configuration file that allows an attacker to obtain a shell...

HongCMS 安全漏洞

HongCMS is an open source lightweight content management system CMS. A security vulnerability exists in HongCMS v3.0, which stems from an issue in the /template/edit component that allows an attacker to obtain a shell...