Hoosk is a web-based platform serving as a focal point for a modestly represented but prominent vulnerability profile, with the recurring exposure centered on application-layer security weaknesses including cross-site scripting, SQL injection, code injection, and cross-site request forgery. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes, reflecting the web application's direct handling of user input and code generation. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Hoosk over time
Signals from CVEs in this vendor scope (14 CVEs).
14 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-16771CRITICAL Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php. | Sep 10, 2018 | 9.8 | 31 | NO | NO |
CVE-2022-43234CRITICAL An arbitrary file upload vulnerability in the /attachments component of Hoosk v1.8 allows attackers to execute arbitrary code via a crafted PHP file. | Nov 16, 2022 | 9.8 | 30 | NO | NO |
CVE-2020-26042CRITICAL An issue was discovered in Hoosk CMS v1.8.0. There is a SQL injection vulnerability in install/index.php | Sep 30, 2020 | 9.8 | 28 | NO | NO |
CVE-2020-26041CRITICAL An issue was discovered in Hoosk CmS v1.8.0. There is an Remote Code Execution vulnerability in install/index.php | Sep 30, 2020 | 9.8 | 28 | NO | NO |
CVE-2018-7590HIGH CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulting in account creation. | Mar 1, 2018 | 8.8 | 26 | NO | NO |
CVE-2022-28586MEDIUM XSS in edit page of Hoosk 1.8.0 allows attacker to execute javascript code in user browser via edit page with XSS payload bypass filter some special chars. | Apr 25, 2022 | 6.1 | 20 | NO | NO |
CVE-2021-43478MEDIUM A vulnerability exists in Hoosk 1.8.0 in /install/index.php, due to a failure to check if config.php already exists in the root directory, which could let a malicious user reinstal | Mar 31, 2022 | 5.4 | 20 | NO | NO |
CVE-2020-26043MEDIUM An issue was discovered in Hoosk CMS v1.8.0. There is a XSS vulnerability in install/index.php | Sep 30, 2020 | 6.1 | 19 | NO | NO |
CVE-2025-25990MEDIUM Cross Site Scripting vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component. | Feb 14, 2025 | 6.1 | 18 | NO | NO |
CVE-2018-16772MEDIUM Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new. | Sep 10, 2018 | 4.8 | 18 | NO | NO |
Signals from CVEs in this vendor scope (14 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Hoosk.
Media articles that mention a CVE ID that affects a product developed by Hoosk — matched by CVE ID, not by vendor name.