Approved changes feed: RSS · Atom
cpe:2.3:a:sitejo:hape_pkh:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Sitejo (4d4c2e04-e72e-5262-b761-d16345da8f05) |
|---|---|
| Product | Hape Pkh (e0f1740e-8f87-524f-a667-589b35f9543c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2018-25391 |
vulnerable | 2026-06-08 05:11:29.868990 |
HaPe PKH 1.1 Missing Authorization Allows Unauthenticated Record Deletion
HIGH (7.5)
HaPe PKH 1.1 fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to delete arbitrary records by sending a crafted request that specifies the target record's id. The admin/modul/mod_pengurus/aksi_pengurus.php (module=pengurus&act=hapus) and admin/modul/mod_update/aksi_update.php (module=update&act=hapus) endpoints process deletions without verifying the requester's privileges, enabling removal of pengurus (administrator) and update records.
Published: 2026-05-29T14:46:34.617Z
Updated: 2026-05-29T19:25:37.368Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-25390 |
vulnerable | 2026-06-08 05:11:29.868673 |
HaPe PKH 1.1 SQL Injection via desa Parameter
HIGH (8.2)
HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'desa' POST parameter sent to lap-peserta-perdesa-pdf.php. Attackers can send a crafted request with a time-based blind payload to infer and extract sensitive database information.
Published: 2026-05-29T14:46:33.895Z
Updated: 2026-05-29T20:35:28.280Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-25389 |
vulnerable | 2026-06-08 05:11:29.868253 |
HaPe PKH 1.1 SQL Injection via nama_kelompok Parameter
HIGH (8.2)
HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'nama_kelompok' POST parameter sent to lap-anggota-kelompok-pdf.php. Attackers can send a crafted request with a time-based blind payload to infer and extract sensitive database information.
Published: 2026-05-29T14:46:33.184Z
Updated: 2026-06-02T18:51:50.138Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-25388 |
vulnerable | 2026-06-08 05:11:29.867924 |
HaPe PKH 1.1 Arbitrary File Upload via aksi_foto.php
HIGH (8.8)
HaPe PKH 1.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by bypassing file type validation. Attackers can upload PHP files through multiple endpoints including aksi_foto.php, aksi_user.php, and aksi_kecamatan.php to execute arbitrary code on the server.
Published: 2026-05-29T14:46:32.498Z
Updated: 2026-05-29T17:25:15.068Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-25387 |
vulnerable | 2026-06-08 05:11:29.867564 |
HaPe PKH 1.1 Cross-Site Request Forgery via aksi_user.php
MEDIUM (5.3)
HaPe PKH 1.1 contains a cross-site request forgery vulnerability that allows attackers to change administrator passwords by submitting forged requests to the user update endpoint. Attackers can craft malicious forms targeting the aksi_user.php script with parameters like id_user, password, and level to modify admin credentials without authentication.
Published: 2026-05-29T14:46:31.802Z
Updated: 2026-06-02T01:31:20.317Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-25386 |
vulnerable | 2026-06-08 05:11:29.867054 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.