Zzcms
by Zzcms
Source repositories
CVEs (119)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-40282 | Hig | 0.57 | 8.8 | 0.01 | Dec 9, 2021 | An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, abd 2021 in dl/dl_download.php. when registering ordinary users. | ||
| CVE-2021-40281 | Hig | 0.57 | 8.8 | 0.01 | Dec 9, 2021 | An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dl_print.php when registering ordinary users. | ||
| CVE-2020-23630 | Hig | 0.57 | 8.8 | 0.01 | Jan 11, 2021 | A blind SQL injection vulnerability exists in zzcms ver201910 based on time (cookie injection). | ||
| CVE-2018-17415 | Hig | 0.57 | 8.8 | 0.01 | Mar 7, 2019 | zzcms V8.3 has a SQL injection in /user/zs_elite.php via the id parameter. | ||
| CVE-2018-17414 | Hig | 0.57 | 8.8 | 0.01 | Mar 7, 2019 | zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter. | ||
| CVE-2018-14963 | Hig | 0.57 | 8.8 | 0.01 | Aug 6, 2018 | zzcms 8.3 has CSRF via the admin/adminadd.php?action=add URI. | ||
| CVE-2023-45555 | Hig | 0.51 | 7.8 | 0.01 | Oct 25, 2023 | File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via a crafted file to the down_url function in zzz.php file. | ||
| CVE-2021-45347 | Hig | 0.49 | 7.5 | 0.01 | Feb 14, 2022 | An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name in the cookie to use any password. | ||
| CVE-2020-19961 | Hig | 0.49 | 7.5 | 0.02 | Oct 14, 2021 | A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component subzs.php. | ||
| CVE-2020-19960 | Hig | 0.49 | 7.5 | 0.02 | Oct 14, 2021 | A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl_sendsms.php page cookie. | ||
| CVE-2020-19959 | Hig | 0.49 | 7.5 | 0.02 | Oct 14, 2021 | A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl_sendmail.php page cookie. | ||
| CVE-2020-19957 | Hig | 0.49 | 7.5 | 0.02 | Oct 14, 2021 | A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parameter on the /dl/dl_print.php page. | ||
| CVE-2020-21342 | Hig | 0.49 | 7.5 | 0.01 | May 13, 2021 | Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php. | ||
| CVE-2019-8411 | Hig | 0.49 | 7.5 | 0.03 | Feb 17, 2019 | admin/dl_data.php in zzcms 2018 (2018-10-19) allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal. | ||
| CVE-2018-16344 | Hig | 0.49 | 7.5 | 0.02 | Sep 2, 2018 | An issue was discovered in zzcms 8.3. It allows remote attackers to delete arbitrary files via directory traversal sequences in the flv parameter. This can be leveraged for database access by deleting install.lock. | ||
| CVE-2018-13056 | Hig | 0.49 | 7.5 | 0.01 | Jul 2, 2018 | An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcms_main table and then making an img add request. This can be leveraged for database access by deleting install.lock. | ||
| CVE-2018-9331 | Hig | 0.49 | 7.5 | 0.03 | Apr 7, 2018 | An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock. | ||
| CVE-2018-8969 | Hig | 0.49 | 7.5 | 0.03 | Mar 24, 2018 | An issue was discovered in zzcms 8.2. user/licence_save.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock. | ||
| CVE-2018-8968 | Hig | 0.49 | 7.5 | 0.03 | Mar 24, 2018 | An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock. | ||
| CVE-2018-8966 | Hig | 0.49 | 7.5 | 0.02 | Mar 24, 2018 | An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo() call into /inc/config.php. |
- risk 0.57cvss 8.8epss 0.01
An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, abd 2021 in dl/dl_download.php. when registering ordinary users.
- risk 0.57cvss 8.8epss 0.01
An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dl_print.php when registering ordinary users.
- risk 0.57cvss 8.8epss 0.01
A blind SQL injection vulnerability exists in zzcms ver201910 based on time (cookie injection).
- risk 0.57cvss 8.8epss 0.01
zzcms V8.3 has a SQL injection in /user/zs_elite.php via the id parameter.
- risk 0.57cvss 8.8epss 0.01
zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter.
- risk 0.57cvss 8.8epss 0.01
zzcms 8.3 has CSRF via the admin/adminadd.php?action=add URI.
- risk 0.51cvss 7.8epss 0.01
File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via a crafted file to the down_url function in zzz.php file.
- risk 0.49cvss 7.5epss 0.01
An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name in the cookie to use any password.
- risk 0.49cvss 7.5epss 0.02
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component subzs.php.
- risk 0.49cvss 7.5epss 0.02
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl_sendsms.php page cookie.
- risk 0.49cvss 7.5epss 0.02
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl_sendmail.php page cookie.
- risk 0.49cvss 7.5epss 0.02
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parameter on the /dl/dl_print.php page.
- risk 0.49cvss 7.5epss 0.01
Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php.
- risk 0.49cvss 7.5epss 0.03
admin/dl_data.php in zzcms 2018 (2018-10-19) allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal.
- risk 0.49cvss 7.5epss 0.02
An issue was discovered in zzcms 8.3. It allows remote attackers to delete arbitrary files via directory traversal sequences in the flv parameter. This can be leveraged for database access by deleting install.lock.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcms_main table and then making an img add request. This can be leveraged for database access by deleting install.lock.
- risk 0.49cvss 7.5epss 0.03
An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock.
- risk 0.49cvss 7.5epss 0.03
An issue was discovered in zzcms 8.2. user/licence_save.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock.
- risk 0.49cvss 7.5epss 0.03
An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock.
- risk 0.49cvss 7.5epss 0.02
An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo() call into /inc/config.php.
Page 3 of 6