CVE-2019-1010193

Summary: CVE-2019-1010193 affects Hisiphp 1.0.8, a ThinkPHP/Layui-based framework. Vulnerability: Cross-Site Scripting (XSS) due to insufficient validation of client-supplied data in the web application. Root cause: lack of proper input validation in the affected web interface/component. Impact (...

CVE-2024-33445

CVE-2024-33445 affects hisiphp v2.0.111. A remote attacker can execute arbitrary code by sending a crafted script to SystemPlugins::mkInfo in SystemPlugins.php. CVSS v3.1 base score 9.8 (CRITICAL): Network, no privileges, no user interaction; confidentiality/integrity/availability all high. Publi...

CVE-2020-28062

CVE-2020-28062 — HisiPHP 2.0.11 : An Access Control vulnerability exists where specially crafted packets in code constructing directories (notably involving the path containing / Upload/Plugins /) can enable a remote attacker to execute arbitrary code. Multiple connected sources corroborate the s...

CVE-2020-21130

CVE-2020-21130 affects HisiPHP 2.0.8 with a reflected/stored? cross-site scripting via the group name in addgroup.html. The Connected documents confirm multiple sources reporting the same XSS vector but do not provide concrete details on affected versions beyond 2.0.8, root cause, or a published ...

CVE-2018-17826

HisiPHP 1.0.8 is vulnerable to CSRF via admin.php/admin/user/adduser.html, enabling an attacker to create an administrator account. This account can then leverage app/common/model/AdminAnnex.php to add .php to the allowed file-upload types list (.jpg, .png, .gif, .jpeg, .ico), facilitating arbitr...

CVE-2018-17827

CVE-2018-17827 affects HisiPHP 1.0.8. A remote attacker can execute arbitrary PHP code by crafting a plugin name, which is injected into app/admin/model/AdminPlugins.php. The connected documents provide the technical vector and affected component but do not include a remediation or patched versio...