CVE-2019-17610

CVE-2019-17610 affects HongCMS 3.0.0 with a cross-site scripting (XSS) vulnerability in the install/index.php dbpassword parameter. The root cause is a lack of proper input validation or encoding for the dbpassword field, enabling injection of malicious script when data is reflected in the page. ...

CVE-2019-17611

HongCMS 3.0.0 is affected by a Cross-Site Scripting (XSS) vulnerability in the install/index.php tableprefix parameter. The issue allows injection of client-side script via the tableprefix input, enabling potentially arbitrary code execution in the context of a user session. The available documen...

CVE-2019-17607

CVE-2019-17607 affects HongCMS 3.0.0 with a cross-site scripting (XSS) vulnerability exploitable via the install/index.php servername parameter. Reported impact in CNVD/NVD notes client-side code execution; the CNVD entry explicitly describes XSS, while the NVD entry summarizes the risk. The avai...

CVE-2019-17609

CVE-2019-17609 : HongCMS 3.0.0 exposes a cross-site scripting vulnerability via the install/index.php dbusername parameter. The issue is described across multiple sources (NVD/CNVD) as allowing client-side code execution in the context of an affected user. CVSSv3.1 base score is 6.1 (MEDIUM) with...

CVE-2019-17608

Affected software: HongCMS 3.0.0. Vulnerability: Cross-Site Scripting via the install/index.php dbname parameter. Vector/Root cause: unsanitized/input handling leads to client-side script execution. Impact: attacker can execute client-side code. References: NVD entry describes XSS via the dbname ...

CVE-2022-28523

CVE-2022-28523 affects HongCMS 3.0.0. The vulnerability allows arbitrary file deletion through the admin component at /admin/index.php/template/ajax?action=delete. The issue is described as a file-deletion capability introduced by this endpoint, leading to potential impact on confidentiality/inte...

CVE-2018-12912

HongCMS 3.0.0 contains a SQL Injection vulnerability in admin/controllers/database.php, exploitable via the request admin/index.php/database/operate?dbaction=emptytable&tablename= (URI). Public exploit/activity references show an authenticated/remote-exploit path using this parameter to inject SQ...

CVE-2022-32412

CVE-2022-32412 affects HongCMS v3.0. The issue resides in the "/template/edit" component, described as allowing attackers to get shell access. The available connected sources consistently reference a remote-code-execution/getshell impact via that component, with no publicly disclosed exploit deta...

CVE-2022-32411

The CVE-2022-32411 issue affects HongCMS v3.0, arising from a flaw in the languages configuration file that can allow an attacker to obtain a shell. The available connected documents consistently associate this vulnerability with HongCMS v3.0 and describe the impact as shell access, but they do n...

CVE-2020-18178

CVE-2020-18178 affects HongCMS v4.0.0. A path traversal vulnerability allows remote attackers to view, edit, and delete arbitrary files by crafting a POST request to /hcms/admin/index.php/language/ajax. Multiple sources (NVD, CNVD/CNNVD, Red Hat entry) confirm the issue; CVE details indicate high...

CVE-2020-21252

CVE-2020-21252 affects Neeke HongCMS 3.0.0. The vulnerability is a CSRF issue that can let an attacker remotely execute arbitrary code and elevate privileges via the updateusers parameter. Documented under CVE-2020-21252 with CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (base score 8.8). Exploi...

CVE-2018-16774

CVE-2018-16774 concerns HongCMS 3.0.0, where an improper validation in the file parameter enables directory traversal to delete files via admin/index.php/language/ajax?action=delete (and related path admin/index.php/database/ajax?action=delete). The underlying issue is a traversal vulnerability t...

CVE-2018-12266

CVE-2018-12266 affects HongCMS 3.0.0, with a cross-site scripting vulnerability in system\errors\404.php triggered by crafted input that leads to a 404 response. Public sources (NVD/CNVD) describe an XSS flaw in this page; no patch/version details are provided in the supplied documents. The root ...

CVE-2020-21643

HongCMS 3.0 is affected by a Cross Site Scripting (XSS) vulnerability that allows an attacker to run arbitrary code via the callback parameter to /ajax/myshop. Affected component: HongCMS 3.0; root cause: unsanitized callback parameter in the /ajax/myshop endpoint. Impact per sources: XSS with po...

CVE-2018-10422

CVE-2018-10422 : Multiple connected sources confirm a Stored Cross-Site Scripting vulnerability in HongCMS 3.0.0, specifically in the post news feature via the content field. The root cause is a lack of input sanitization/escaping in content handling, allowing arbitrary script/html injection. Aff...

CVE-2019-16867

HongCMS 3.0.0 is affected by a path-traversal vulnerability allowing arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete (and similar CVE-2018-16774 path). Root cause is insufficient validation of the file path, enabling deletion of critical file...

CVE-2020-21431

HongCMS v3.0 contains an access control error vulnerability in the /admin/index.php/template/edit page, leading to arbitrary file reads and writes. The issue stems from missing/incorrect permission checks on that endpoint, enabling an attacker to read or write arbitrary files. Public references c...

CVE-2018-13021

HongCMS 3.0.0 is affected by CVE-2018-13021 due to an Arbitrary Script File Upload vulnerability exploited via admin/index.php/template/upload, enabling PHP code execution. Multiple connected sources (e.g., CNVD-2018-16275, NVD entry) confirm the vulnerability and impact. The root cause is an ins...

CVE-2018-10265

This CVE (CVE-2018-10265) affects HongCMS v3.0.0 and is a CSRF flaw on the admin/users/save endpoint that can add an administrator account. Root cause: CSRF protections not adequately enforced on the admin path. Impact (per provided metrics): CVSSv3 base score 8.8 (HIGH), with network attack vect...

CVE-2019-8407

HongCMS 3.0.0 is affected by CVE-2019-8407 due to a path traversal in the filename parameter of admin/index.php/language/edit, allowing arbitrary file read and write. The underlying cause is improper handling of "../" in the filename, enabling access to sensitive files. Impact: partial confidenti...