Design/Logic Flaw

HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter...

CVE-2019-17609

CVE-2019-17609 : HongCMS 3.0.0 exposes a cross-site scripting vulnerability via the install/index.php dbusername parameter. The issue is described across multiple sources (NVD/CNVD) as allowing client-side code execution in the context of an affected user. CVSSv3.1 base score is 6.1 (MEDIUM) with...

CVE-2019-17609

HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter...

CVE-2019-17608

Affected software: HongCMS 3.0.0. Vulnerability: Cross-Site Scripting via the install/index.php dbname parameter. Vector/Root cause: unsanitized/input handling leads to client-side script execution. Impact: attacker can execute client-side code. References: NVD entry describes XSS via the dbname ...

CVE-2019-17608

HongCMS 3.0.0 has XSS via the install/index.php dbname parameter...

CVE-2019-17607

HongCMS 3.0.0 has XSS via the install/index.php servername parameter...

PT-2019-15228

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue is related to a security problem where an attacker can execute malicious scripts. This is achieved by exploiting the dbname parameter in the "install/index.php" endpoint. Recommendations For HongCMS...

PT-2019-15229

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue is related to a security problem where an attacker can inject malicious code. The estimated number of potentially affected devices is not provided. Technical details about exploitation include the...

CVE-2019-17609: Improper Neutralization of Input During Web Page Generation

HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter...

CVE-2019-17607: Improper Neutralization of Input During Web Page Generation

HongCMS 3.0.0 has XSS via the install/index.php servername parameter...

CVE-2019-17611: Improper Neutralization of Input During Web Page Generation

HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter...

PT-2019-15231

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue is related to a security problem where an attacker can inject malicious code. This is possible due to the lack of proper input validation in the tableprefix parameter of the install/index.php file...

CVE-2019-17608: Improper Neutralization of Input During Web Page Generation

HongCMS 3.0.0 has XSS via the install/index.php dbname parameter...

CVE-2019-17610: Improper Neutralization of Input During Web Page Generation

HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter...

PT-2019-15227

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue is related to a security problem where an attacker can execute malicious scripts on the website. This is achieved by exploiting the servername parameter in the install/index.php endpoint...

PT-2019-15230

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue is related to a security problem where an attacker can inject malicious code. The estimated number of potentially affected devices is not provided. Technical details about exploitation include the...

CVE-2019-17612

An issue was discovered in 74CMS v5.2.8. There is a SQL Injection generated by the list method in the Common/Controller/BackendController.class.php file via the index.php?m=Admin&c=Ad&a=category sort parameter...

CVE-2019-17613

qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in...

CVE-2019-17613

qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in...

CVE-2019-17613: Improper Control of Generation of Code

qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in...