hongcms_project 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
過去の問題は主に vendor risk cross-site scripting and パス処理の欠陥 などに関し、一部は vendor impact session compromise を招き、vendor surface software deployment and vendor surface production workloads 関連の場面に影響します。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2020-21252 | Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges via the updateusers parameter. | [email protected] | 8.8 | 0.90% | 2023-06-20 | 2024-12-10 |
| CVE-2020-21643 | Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop. | [email protected] | 6.1 | 0.22% | 2023-04-28 | 2025-01-31 |
| CVE-2022-32412 | An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell. | [email protected] | 7.2 | 0.36% | 2022-07-01 | 2024-11-21 |
| CVE-2022-32411 | An issue in the languages config file of HongCMS v3.0 allows attackers to getshell. | [email protected] | 7.2 | 0.36% | 2022-07-01 | 2024-11-21 |
| CVE-2022-28523 | HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete. | [email protected] | 8.1 | 0.45% | 2022-04-26 | 2024-11-21 |
| CVE-2020-21431 | HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit. | [email protected] | 6.5 | 0.32% | 2021-10-04 | 2024-11-21 |
| CVE-2020-18178 | Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax." | [email protected] | 9.8 | 1.78% | 2021-05-18 | 2024-11-21 |
| CVE-2019-17611 | HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter. | [email protected] | 6.1 | 0.42% | 2019-10-16 | 2024-11-21 |
| CVE-2019-17610 | HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter. | [email protected] | 6.1 | 0.42% | 2019-10-16 | 2024-11-21 |
| CVE-2019-17609 | HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter. | [email protected] | 6.1 | 0.42% | 2019-10-16 | 2024-11-21 |
| CVE-2019-17608 | HongCMS 3.0.0 has XSS via the install/index.php dbname parameter. | [email protected] | 6.1 | 0.42% | 2019-10-16 | 2024-11-21 |
| CVE-2019-17607 | HongCMS 3.0.0 has XSS via the install/index.php servername parameter. | [email protected] | 6.1 | 0.42% | 2019-10-16 | 2024-11-21 |
| CVE-2019-16867 | HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. (If the attacker deletes config.php and visits install/index.php, they can reinstall the product.) | [email protected] | 6.5 | 0.33% | 2019-09-25 | 2024-11-21 |
| CVE-2019-8407 | HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI. | [email protected] | 6.5 | 0.52% | 2019-02-17 | 2024-11-21 |
| CVE-2018-16774 | HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete. | [email protected] | 7.5 | 0.52% | 2018-09-10 | 2024-11-21 |
| CVE-2018-13021 | An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI. | [email protected] | 7.2 | 1.44% | 2018-06-29 | 2024-11-21 |
| CVE-2018-12912 | An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI. | [email protected] | 7.2 | 1.78% | 2018-06-27 | 2024-11-21 |
| CVE-2018-12266 | system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code. | [email protected] | 6.1 | 0.24% | 2018-06-13 | 2024-11-21 |
| CVE-2018-10422 | An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field. | [email protected] | 4.8 | 0.24% | 2018-04-26 | 2024-11-21 |
| CVE-2018-10265 | An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI. | [email protected] | 8.8 | 0.07% | 2018-04-22 | 2024-11-21 |