Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
20 results
Jun 20, 2023Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges via the updateusers pCVE-2020-21252 · Other software · Hongcms Project · reported by MITREHigh 8.8
Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges via the updateusers parameter.
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop.CVE-2020-21643 · Other software · Hongcms Project · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop.
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell.CVE-2022-32412 · Other software · Hongcms Project · reported by MITREHigh 7.2
An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell.
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022An issue in the languages config file of HongCMS v3.0 allows attackers to getshell.CVE-2022-32411 · Other software · Hongcms Project · reported by MITREHigh 7.2
An issue in the languages config file of HongCMS v3.0 allows attackers to getshell.
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2022HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete.CVE-2022-28523 · Other software · Hongcms Project · reported by MITREHigh 8.1
HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete.
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit.CVE-2020-21431 · Other software · Hongcms Project · reported by MITREMedium 6.5
HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit.
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2021Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/indeCVE-2020-18178 · Other software · Hongcms Project · reported by MITRECritical 9.8
Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax."
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2019HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter.CVE-2019-17611 · Other software · Hongcms Project · reported by MITREMedium 6.1
HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter.
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn1.imggmi.comcdn1.imggmi.com
Oct 16, 2019HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter.CVE-2019-17610 · Other software · Hongcms Project · reported by MITREMedium 6.1
HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter.
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn1.imggmi.comcdn1.imggmi.com
Oct 16, 2019HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter.CVE-2019-17609 · Other software · Hongcms Project · reported by MITREMedium 6.1
HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter.
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn1.imggmi.comcdn1.imggmi.com
Oct 16, 2019HongCMS 3.0.0 has XSS via the install/index.php dbname parameter.CVE-2019-17608 · Other software · Hongcms Project · reported by MITREMedium 6.1
HongCMS 3.0.0 has XSS via the install/index.php dbname parameter.
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn1.imggmi.comcdn1.imggmi.com
Oct 16, 2019HongCMS 3.0.0 has XSS via the install/index.php servername parameter.CVE-2019-17607 · Other software · Hongcms Project · reported by MITREMedium 6.1
HongCMS 3.0.0 has XSS via the install/index.php servername parameter.
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn1.imggmi.comcdn1.imggmi.com
Sep 25, 2019HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774.CVE-2019-16867 · Other software · Hongcms Project · reported by MITREMedium 6.5
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. (If the attacker deletes config.php and visits install/index.php, they can reinstall the product.)
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2019HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI.CVE-2019-8407 · Other software · Hongcms Project · reported by MITREMedium 6.5
HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI.
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2018HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete.CVE-2018-16774 · Other software · Hongcms Project · reported by MITREHigh 7.5
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete.
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2018An issue was discovered in HongCMS 3.0.0.CVE-2018-13021 · Other software · Hongcms Project · reported by MITREHigh 7.2
An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI.
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2018An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0.CVE-2018-12912 · Other software · Hongcms Project · reported by MITREHigh 7.2
An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI.
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jun 13, 2018system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code.CVE-2018-12266 · Other software · Hongcms Project · reported by MITREMedium 6.1
system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code.
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2018An issue was discovered in HongCMS 3.0.0.CVE-2018-10422 · Other software · Hongcms Project · reported by MITREMedium 4.8
An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field.
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2018An issue was discovered in HongCMS v3.0.0.CVE-2018-10265 · Other software · Hongcms Project · reported by MITREHigh 8.8
An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI.
- Product
- Hongcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.