An Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6.07 allows a remote, authenticated attacker to escalate their privileges.
ZwiiCMS versions prior to 13.7.00 contain a denial-of-service vulnerability in multiple administrative endpoints due to improper authorization checks combined with flawed resource state management.
CVSS 4.0MEDIUM 5.3·Network·Low privileges·No interaction·EPSS 0.00223·Published 2025-12-31·Fixed in 13.7.00CWE-667
