CVE-2019-17610

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cdn1.imggmi.com/uploads/2019/10/13/94ef1b084a074ffd9ef63408529aed17-full.pngExploit, Third Party Advisory
https://cdn1.imggmi.com/uploads/2019/10/13/e561884443c495286993e186f44dfd1f-full.pngExploit, Third Party Advisory
https://cxsecurity.com/issue/WLB-2019100100Third Party Advisory
https://cdn1.imggmi.com/uploads/2019/10/13/94ef1b084a074ffd9ef63408529aed17-full.pngExploit, Third Party Advisory
https://cdn1.imggmi.com/uploads/2019/10/13/e561884443c495286993e186f44dfd1f-full.pngExploit, Third Party Advisory
https://cxsecurity.com/issue/WLB-2019100100Third Party Advisory

Timeline

Published: Oct 16, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-176116.1HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter.CVE-2019-176127.2An issue was discovered in 74CMS v5.2.8. There is a SQL Injection generated by the _list method in the Common/Controller/BackendController.c CVE-2019-176139.8qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature t CVE-2019-17624.4A vulnerability in the Secure Storage feature of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to access sensit CVE-2019-176219.8The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to exec CVE-2019-176247.8"" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. For example, by sending ct.c_char 1000 tim CVE-2019-176259.0There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The prob CVE-2019-176269.8ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document CVE-2019-176276.5The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy (BLE) traffic duri CVE-2019-176294.8CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen.CVE-2019-17637.5A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could all CVE-2019-176304.8CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen.