Neeke/HongCMS

GitHub

github.com

Releases0

Stars23

HongCMS中英文网站系统是一个轻量级的网站系统，访问速度极快，使用简单。程序代码简洁严谨，完全免费开源。可用于建设各种类型的中英文网站，同时它是一个小型开发框架.

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2020-21252 ↗	Jun 20, 2023Tuesday, 20 June 2023, 15:15	8.8 HIGH	—
Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges via the updateusers parameter.
CVE-2020-21643 ↗	Apr 28, 2023Friday, 28 April 2023, 20:15	6.1 MEDIUM	—
Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop.
CVE-2022-32412 ↗	Jul 1, 2022Friday, 1 July 2022, 22:15	7.2 HIGH	6.5 MEDIUM
An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell.
CVE-2022-32411 ↗	Jul 1, 2022Friday, 1 July 2022, 22:15	7.2 HIGH	6.5 MEDIUM
An issue in the languages config file of HongCMS v3.0 allows attackers to getshell.
CVE-2022-28523 ↗	Apr 26, 2022Tuesday, 26 April 2022, 21:15	8.1 HIGH	5.5 MEDIUM
HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete.
CVE-2020-21431 ↗	Oct 4, 2021Monday, 4 October 2021, 21:15	6.5 MEDIUM	5.5 MEDIUM
HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit.
CVE-2020-18178 ↗	May 18, 2021Tuesday, 18 May 2021, 19:15	9.8 CRITICAL	7.5 HIGH
Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax."
CVE-2019-16867 ↗	Sep 25, 2019Wednesday, 25 September 2019, 12:15	6.5 MEDIUM	5.5 MEDIUM
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. (If the attacker deletes config.php and visits install/index.php, they can reinstall the product.)
CVE-2019-8407 ↗	Feb 17, 2019Sunday, 17 February 2019, 18:29	—	5.5 MEDIUM
HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI.
CVE-2018-16774 ↗	Sep 10, 2018Monday, 10 September 2018, 04:29	—	6.4 MEDIUM
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete.
CVE-2018-13021 ↗	Jun 29, 2018Friday, 29 June 2018, 17:29	—	9 HIGH
An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI.
CVE-2018-12912 ↗	Jun 27, 2018Wednesday, 27 June 2018, 18:29	—	6.5 MEDIUM
An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI.
CVE-2018-10422 ↗	Apr 26, 2018Thursday, 26 April 2018, 05:29	—	3.5 LOW
An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field.
CVE-2018-10265 ↗	Apr 22, 2018Sunday, 22 April 2018, 01:29	—	6.8 MEDIUM
An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI.