CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 01/07/2022 |
| CVE-2022-28523 | 높음8.1 | HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete. | 26/04/2022 |
| CVE-2020-21431 | 보통6.5 | HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit. | 04/10/2021 |
| CVE-2020-18178 | 심각9.8 | Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax." | 18/05/2021 |
| CVE-2019-17611 | 보통6.1 | HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter. | 16/10/2019 |
| CVE-2019-17610 | 보통6.1 | HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter. | 16/10/2019 |
| CVE-2019-17609 | 보통6.1 | HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter. | 16/10/2019 |
| CVE-2019-17608 | 보통6.1 | HongCMS 3.0.0 has XSS via the install/index.php dbname parameter. | 16/10/2019 |
| CVE-2019-17607 | 보통6.1 | HongCMS 3.0.0 has XSS via the install/index.php servername parameter. | 16/10/2019 |
| CVE-2019-16867 | 보통6.5 | HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. (If the attacker deletes config.php and visits install/index.php, they can reinstall the product.) | 25/09/2019 |
| CVE-2019-8407 | 보통6.5 | HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI. | 17/02/2019 |
| CVE-2018-16774 | 높음7.5 | HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete. | 10/09/2018 |
| CVE-2018-13021 | 높음7.2 | An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI. | 29/06/2018 |
| CVE-2018-12912 | 높음7.2 | An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI. | 27/06/2018 |
| CVE-2018-12266 | 보통6.1 | system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code. | 13/06/2018 |
| CVE-2018-10422 | 보통4.8 | An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field. | 26/04/2018 |
| CVE-2018-10265 | 높음8.8 | An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI. | 22/04/2018 |