CVE-2019-1010193

Summary: CVE-2019-1010193 affects Hisiphp 1.0.8, a ThinkPHP/Layui-based framework. Vulnerability: Cross-Site Scripting (XSS) due to insufficient validation of client-supplied data in the web application. Root cause: lack of proper input validation in the affected web interface/component. Impact (...

CVE-2020-21130

CVE-2020-21130 affects HisiPHP 2.0.8 with a reflected/stored? cross-site scripting via the group name in addgroup.html. The Connected documents confirm multiple sources reporting the same XSS vector but do not provide concrete details on affected versions beyond 2.0.8, root cause, or a published ...

CVE-2024-33445

An arbitrary code execution vulnerability exists in hisiphp v2.0.111 within the SystemPlugins.php component. A remote attacker can exploit this by sending a crafted script to the SystemPlugins::mkInfo parameter. The impact is significant as it allows for remote code execution. To mitigate this ri...

CVE-2020-28062

CVE-2020-28062 — HisiPHP 2.0.11 : An Access Control vulnerability exists where specially crafted packets in code constructing directories (notably involving the path containing / Upload/Plugins /) can enable a remote attacker to execute arbitrary code. Multiple connected sources corroborate the s...

CVE-2018-17826

HisiPHP 1.0.8 is vulnerable to CSRF via admin.php/admin/user/adduser.html, enabling an attacker to create an administrator account. This account can then leverage app/common/model/AdminAnnex.php to add .php to the allowed file-upload types list (.jpg, .png, .gif, .jpeg, .ico), facilitating arbitr...

CVE-2018-17827

CVE-2018-17827 affects HisiPHP 1.0.8. A remote attacker can execute arbitrary PHP code by crafting a plugin name, which is injected into app/admin/model/AdminPlugins.php. The connected documents provide the technical vector and affected component but do not include a remediation or patched versio...