PT-2021-3633

Name of the Vulnerable Software and Affected Versions Hongcms versions 4.0.0 Description The issue is related to a path traversal vulnerability in the /hcms/admin/index.php/language/ajax component of the Hongcms content management system. This vulnerability can be exploited by a remote attacker t...

CVE-2020-18178: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax."...

Arbitrary file deletion

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete...

PT-2018-13738

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue allows for arbitrary file deletion. This can be achieved by manipulating the file parameter in the /admin/index.php/language/ajax endpoint with a ../ sequence and setting the action parameter to...

CVE-2018-16774: Improper Limitation of a Pathname to a Restricted Directory

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete...