Search
Total
10 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-45286 | 1 Zzcms | 1 Zzcms | 2022-02-15 | 5.0 MEDIUM | 5.3 MEDIUM |
| Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1) index.php, 2) bottom.php, and 3) top_index.php. | |||||
| CVE-2018-7434 | 1 Zzcms | 1 Zzcms | 2022-02-07 | 5.0 MEDIUM | 5.3 MEDIUM |
| zzcms 8.2 allows remote attackers to discover the full path via a direct request to 3/qq_connect2.0/API/class/ErrorCase.class.php or 3/ucenter_api/code/friend.php. | |||||
| CVE-2020-19042 | 1 Zzcms | 1 Zzcms | 2021-12-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability exists in zzcms 2019 XSS via a modify action in user/adv.php. | |||||
| CVE-2020-35973 | 1 Zzcms | 1 Zzcms | 2021-06-09 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in zzcms2020. There is a XSS vulnerability that can insert and execute JS code arbitrarily via /user/manage.php. | |||||
| CVE-2020-20285 | 1 Zzcms | 1 Zzcms | 2020-12-22 | 3.5 LOW | 5.4 MEDIUM |
| There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php | |||||
| CVE-2018-17798 | 1 Zzcms | 1 Zzcms | 2020-08-24 | 5.5 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in zzcms 8.3. user/ztconfig.php allows remote attackers to delete arbitrary files via an absolute pathname in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock. | |||||
| CVE-2018-17413 | 1 Zzcms | 1 Zzcms | 2019-03-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter. | |||||
| CVE-2019-9078 | 1 Zzcms | 1 Zzcms | 2019-02-25 | 3.5 LOW | 5.4 MEDIUM |
| zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT. | |||||
| CVE-2018-17797 | 1 Zzcms | 1 Zzcms | 2018-11-28 | 5.5 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in zzcms 8.3. user/zssave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock. | |||||
| CVE-2018-14962 | 1 Zzcms | 1 Zzcms | 2018-10-04 | 3.5 LOW | 5.4 MEDIUM |
| zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php. | |||||