Zzcms
by Zzcms
Source repositories
CVEs (119)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-20285 | Med | 0.35 | 5.4 | 0.01 | Dec 18, 2020 | There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php | ||
| CVE-2019-9078 | Med | 0.35 | 5.4 | 0.01 | Feb 24, 2019 | zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT. | ||
| CVE-2018-14962 | Med | 0.35 | 5.4 | 0.01 | Aug 6, 2018 | zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php. | ||
| CVE-2018-7434 | Med | 0.35 | 5.3 | 0.02 | Feb 24, 2018 | zzcms 8.2 allows remote attackers to discover the full path via a direct request to 3/qq_connect2.0/API/class/ErrorCase.class.php or 3/ucenter_api/code/friend.php. | ||
| CVE-2024-10290 | Med | 0.34 | 5.3 | 0.01 | Oct 23, 2024 | A vulnerability, which was classified as problematic, was found in ZZCMS 2023. This affects an unknown part of the file 3/qq-connect2.0/API/com/inc.php. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been… | ||
| CVE-2024-44821 | Med | 0.34 | 5.3 | 0.00 | Sep 4, 2024 | ZZCMS 2023 contains a vulnerability in the captcha reuse logic located in /inc/function.php. The checkyzm function does not properly refresh the captcha value after a failed validation attempt. As a result, an attacker can exploit this flaw by repeatedly submitting the same… | ||
| CVE-2015-7347 | Med | 0.34 | 4.8 | 0.01 | Sep 20, 2017 | Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1. | ||
| CVE-2024-43011 | Med | 0.32 | 4.9 | 0.01 | Aug 16, 2024 | An arbitrary file deletion vulnerability exists in the admin/del.php file at line 62 in ZZCMS 2023 and earlier. Due to insufficient validation and sanitization of user input for file paths, an attacker can exploit this vulnerability by using directory traversal techniques to… | ||
| CVE-2025-14837 | Med | 0.31 | 4.7 | 0.00 | Dec 18, 2025 | A vulnerability has been found in ZZCMS 2025. Affected by this issue is the function stripfxg of the file /admin/siteconfig.php of the component Backend Website Settings Module. Such manipulation of the argument icp leads to code injection. The attack can be executed remotely.… | ||
| CVE-2024-11242 | Med | 0.31 | 4.7 | 0.01 | Nov 15, 2024 | A vulnerability was found in ZZCMS 2023. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/ad_list.php?action=pass of the component Keyword Filtering. The manipulation of the argument keyword leads to sql injection. The attack… | ||
| CVE-2024-43009 | Med | 0.31 | 4.7 | 0.00 | Aug 16, 2024 | A reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value of the HTTP_REFERER header into the HTML response without proper sanitization. An attacker can exploit this… | ||
| CVE-2024-43005 | Med | 0.31 | 4.7 | 0.00 | Aug 16, 2024 | A reflected cross-site scripting (XSS) vulnerability in the component dl_liuyan_save.php of ZZCMS v2023 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload. | ||
| CVE-2021-46437 | Med | 0.31 | 4.8 | 0.00 | Apr 8, 2022 | An issue was discovered in ZZCMS 2021. There is a cross-site scripting (XSS) vulnerability in ad_manage.php. | ||
| CVE-2025-1949 | Med | 0.28 | 4.3 | 0.01 | Mar 4, 2025 | A vulnerability, which was classified as problematic, has been found in ZZCMS 2025. This issue affects some unknown processing of the file /3/ucenter_api/code/register_nodb.php of the component URL Handler. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross… | ||
| CVE-2024-7925 | Med | 0.28 | 4.3 | 0.01 | Aug 19, 2024 | A vulnerability was found in ZZCMS 2023. It has been rated as problematic. This issue affects some unknown processing of the file 3/E_bak5.1/upload/eginfo.php. The manipulation of the argument phome with the input ShowPHPInfo leads to information disclosure. The attack may be… | ||
| CVE-2025-7748 | Low | 0.23 | 3.5 | 0.00 | Jul 17, 2025 | A vulnerability classified as problematic was found in ZCMS 3.6.0. This vulnerability affects unknown code of the component Create Article Page. The manipulation of the argument Title leads to cross site scripting. The attack can be initiated remotely. The exploit has been… | ||
| CVE-2023-5582 | Low | 0.23 | 3.5 | 0.01 | Oct 14, 2023 | A vulnerability, which was classified as problematic, has been found in ZZZCMS 2.2.0. This issue affects some unknown processing of the component Personal Profile Page. The manipulation leads to basic cross site scripting. The attack may be initiated remotely. The exploit has… | ||
| CVE-2025-14836 | Low | 0.18 | 2.7 | 0.00 | Dec 17, 2025 | A flaw has been found in ZZCMS 2025. Affected by this vulnerability is an unknown functionality of the file /reg/user_save.php of the component User Data Storage Module. This manipulation causes cleartext storage in a file or on disk. Remote exploitation of the attack is… | ||
| CVE-2024-11130 | Low | 0.16 | 2.4 | 0.00 | Nov 12, 2024 | A vulnerability was found in ZZCMS up to 2023. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/msg.php. The manipulation of the argument keyword leads to cross site scripting. The attack may be launched remotely. The… |
- risk 0.35cvss 5.4epss 0.01
There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php
- risk 0.35cvss 5.4epss 0.01
zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT.
- risk 0.35cvss 5.4epss 0.01
zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php.
- risk 0.35cvss 5.3epss 0.02
zzcms 8.2 allows remote attackers to discover the full path via a direct request to 3/qq_connect2.0/API/class/ErrorCase.class.php or 3/ucenter_api/code/friend.php.
- risk 0.34cvss 5.3epss 0.01
A vulnerability, which was classified as problematic, was found in ZZCMS 2023. This affects an unknown part of the file 3/qq-connect2.0/API/com/inc.php. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been…
- risk 0.34cvss 5.3epss 0.00
ZZCMS 2023 contains a vulnerability in the captcha reuse logic located in /inc/function.php. The checkyzm function does not properly refresh the captcha value after a failed validation attempt. As a result, an attacker can exploit this flaw by repeatedly submitting the same…
- risk 0.34cvss 4.8epss 0.01
Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1.
- risk 0.32cvss 4.9epss 0.01
An arbitrary file deletion vulnerability exists in the admin/del.php file at line 62 in ZZCMS 2023 and earlier. Due to insufficient validation and sanitization of user input for file paths, an attacker can exploit this vulnerability by using directory traversal techniques to…
- risk 0.31cvss 4.7epss 0.00
A vulnerability has been found in ZZCMS 2025. Affected by this issue is the function stripfxg of the file /admin/siteconfig.php of the component Backend Website Settings Module. Such manipulation of the argument icp leads to code injection. The attack can be executed remotely.…
- risk 0.31cvss 4.7epss 0.01
A vulnerability was found in ZZCMS 2023. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/ad_list.php?action=pass of the component Keyword Filtering. The manipulation of the argument keyword leads to sql injection. The attack…
- risk 0.31cvss 4.7epss 0.00
A reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value of the HTTP_REFERER header into the HTML response without proper sanitization. An attacker can exploit this…
- risk 0.31cvss 4.7epss 0.00
A reflected cross-site scripting (XSS) vulnerability in the component dl_liuyan_save.php of ZZCMS v2023 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
- risk 0.31cvss 4.8epss 0.00
An issue was discovered in ZZCMS 2021. There is a cross-site scripting (XSS) vulnerability in ad_manage.php.
- risk 0.28cvss 4.3epss 0.01
A vulnerability, which was classified as problematic, has been found in ZZCMS 2025. This issue affects some unknown processing of the file /3/ucenter_api/code/register_nodb.php of the component URL Handler. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross…
- risk 0.28cvss 4.3epss 0.01
A vulnerability was found in ZZCMS 2023. It has been rated as problematic. This issue affects some unknown processing of the file 3/E_bak5.1/upload/eginfo.php. The manipulation of the argument phome with the input ShowPHPInfo leads to information disclosure. The attack may be…
- risk 0.23cvss 3.5epss 0.00
A vulnerability classified as problematic was found in ZCMS 3.6.0. This vulnerability affects unknown code of the component Create Article Page. The manipulation of the argument Title leads to cross site scripting. The attack can be initiated remotely. The exploit has been…
- risk 0.23cvss 3.5epss 0.01
A vulnerability, which was classified as problematic, has been found in ZZZCMS 2.2.0. This issue affects some unknown processing of the component Personal Profile Page. The manipulation leads to basic cross site scripting. The attack may be initiated remotely. The exploit has…
- risk 0.18cvss 2.7epss 0.00
A flaw has been found in ZZCMS 2025. Affected by this vulnerability is an unknown functionality of the file /reg/user_save.php of the component User Data Storage Module. This manipulation causes cleartext storage in a file or on disk. Remote exploitation of the attack is…
- risk 0.16cvss 2.4epss 0.00
A vulnerability was found in ZZCMS up to 2023. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/msg.php. The manipulation of the argument keyword leads to cross site scripting. The attack may be launched remotely. The…
Page 6 of 6