CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| CVE-2022-28523 |
| 高8.1 |
HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete. |
| 26/04/2022 |
| CVE-2020-21431 | 中6.5 | HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit. | 04/10/2021 |
| CVE-2020-18178 | 緊急9.8 | Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax." | 18/05/2021 |
| CVE-2019-17611 | 中6.1 | HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter. | 16/10/2019 |
| CVE-2019-17610 | 中6.1 | HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter. | 16/10/2019 |
| CVE-2019-17609 | 中6.1 | HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter. | 16/10/2019 |
| CVE-2019-17608 | 中6.1 | HongCMS 3.0.0 has XSS via the install/index.php dbname parameter. | 16/10/2019 |
| CVE-2019-17607 | 中6.1 | HongCMS 3.0.0 has XSS via the install/index.php servername parameter. | 16/10/2019 |
| CVE-2019-16867 | 中6.5 | HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. (If the attacker deletes config.php and visits install/index.php, they can reinstall the product.) | 25/09/2019 |
| CVE-2019-8407 | 中6.5 | HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI. | 17/02/2019 |
| CVE-2018-16774 | 高7.5 | HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete. | 10/09/2018 |
| CVE-2018-13021 | 高7.2 | An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI. | 29/06/2018 |
| CVE-2018-12912 | 高7.2 | An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI. | 27/06/2018 |
| CVE-2018-12266 | 中6.1 | system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code. | 13/06/2018 |
| CVE-2018-10422 | 中4.8 | An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field. | 26/04/2018 |
| CVE-2018-10265 | 高8.8 | An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI. | 22/04/2018 |