zzcms

Records107All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical30CVSS 9.0–10.0

CVSS high41CVSS 7.0–8.9

Exploited now

zzcms records in CISA KEV

No zzcms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Zzcms 106 records HIGH Zzmcms 1 record MEDIUM

Records

106 records in Zzcms · all components

TI-2024-35279 CVE-2024-52724 · GHSA-m3p7-vcc9-vwjx

ZZCMS 2023 was discovered to contain a SQL injection vulnerability in /q/show.php.

HIGH 82

ZZCMS 2023 was discovered to contain a SQL injection vulnerability in /q/show.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00578 Published 2024-12-02 No fix listed CWE-89

TI-2024-30005 CVE-2024-44817 · GHSA-8c2m-6m99-9w9r

SQL Injection vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain…

HIGH 73

SQL Injection vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via the id parameter in the adv2.php component.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00687 Published 2024-09-04 No fix listed CWE-89

TI-2023-18144 CVE-2023-36162 · GHSA-x6p8-7f9j-2h7f

Cross Site Request Forgery vulnerability in ZZCMS v.2023 and earlier allows a remote…

HIGH 73

Cross Site Request Forgery vulnerability in ZZCMS v.2023 and earlier allows a remote attacker to gain privileges via the add function in adminlist.php.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00544 Published 2023-07-03 No fix listed CWE-352

TI-2025-00469 CVE-2025-0565 · GHSA-jh6q-j2jh-mp6g

ZZCMS index.php sql injection

HIGH 70

A vulnerability was found in ZZCMS 2023.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.01492 Published 2025-01-19 No fix listed CWE-74

TI-2024-07349 CVE-2024-7927 · GHSA-r7gp-vvfr-gpr6

ZZCMS class.php path traversal

HIGH 70

A vulnerability classified as critical was found in ZZCMS 2023.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00932 Published 2024-08-19 No fix listed CWE-22

TI-2024-07348 CVE-2024-7926 · GHSA-8pcq-v58x-j36p

ZZCMS about_edit.php path traversal

MEDIUM 64

A vulnerability classified as critical has been found in ZZCMS 2023.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00932 Published 2024-08-19 No fix listed CWE-22

TI-2024-30006 CVE-2024-44818 · GHSA-39jm-vmh3-fp62

Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to…

MEDIUM 58

Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via the HTTP_Referer header of the caina.php component.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00399 Published 2024-09-04 No fix listed CWE-79

TI-2024-28718 CVE-2024-43006 · GHSA-43p9-cg2h-73x3

A stored cross-site scripting (XSS) vulnerability exists in ZZCMS2023 in the ask/show.php…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability exists in ZZCMS2023 in the ask/show.php file at line 21.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0024 Published 2024-08-16 No fix listed CWE-79

TI-2025-12042 CVE-2025-13171 · GHSA-m4fx-3r3r-w4xv

ZZCMS wangkan_list.php sql injection

MEDIUM 57

A vulnerability was identified in ZZCMS 2023.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00381 Published 2025-11-14 No fix listed CWE-74

TI-2025-01694 CVE-2025-1949 · GHSA-7w6g-vq95-c259

ZZCMS URL register_nodb.php cross site scripting

MEDIUM 57

A vulnerability, which was classified as problematic, has been found in ZZCMS 2025.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00511 Published 2025-03-04 No fix listed CWE-79

TI-2024-09538 CVE-2024-10293 · GHSA-rw27-7fmj-vgcv

ZZCMS functions.php Ebak_SetGotoPak unrestricted upload

MEDIUM 57

A vulnerability was found in ZZCMS 2023.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00517 Published 2024-10-23 No fix listed CWE-434

TI-2024-09537 CVE-2024-10292 · GHSA-67cp-gwr2-6w65

ZZCMS ChangeTable.php unrestricted upload

MEDIUM 57

A vulnerability was found in ZZCMS 2023 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00497 Published 2024-10-23 No fix listed CWE-434

TI-2024-09536 CVE-2024-10291 · GHSA-w8rc-768j-hfvx

ZZCMS phome.php Ebak_DotranExecutSQL sql injection

MEDIUM 57

A vulnerability has been found in ZZCMS 2023 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00482 Published 2024-10-23 No fix listed CWE-89

TI-2024-07347 CVE-2024-7925 · GHSA-f776-8qvr-rf72

ZZCMS eginfo.php information disclosure

MEDIUM 57

A vulnerability was found in ZZCMS 2023.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00635 Published 2024-08-19 No fix listed CWE-200

TI-2025-13534 CVE-2025-14837 · GHSA-gp85-pqj7-66qv

ZZCMS Backend Website Settings siteconfig.php stripfxg code injection

MEDIUM 56

A vulnerability has been found in ZZCMS 2025.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00458 Published 2025-12-17 No fix listed CWE-74

TI-2025-13533 CVE-2025-14836 · GHSA-hqqq-fq68-35hf

ZZCMS User Data Storage user_save.php cleartext storage in file

MEDIUM 56

A flaw has been found in ZZCMS 2025.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00203 Published 2025-12-17 No fix listed CWE-312

TI-2024-28720 CVE-2024-43011 · GHSA-mw3w-8r3q-gm92

An arbitrary file deletion vulnerability exists in the admin/del.php file at line 62 in…

MEDIUM 56

An arbitrary file deletion vulnerability exists in the admin/del.php file at line 62 in ZZCMS 2023 and earlier.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00672 Published 2024-08-16 No fix listed CWE-22

TI-2024-10415 CVE-2024-11242 · GHSA-q79q-mvw6-5crr

ZZCMS Keyword Filtering ad_list.php sql injection

MEDIUM 56

A vulnerability was found in ZZCMS 2023.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00569 Published 2024-11-15 No fix listed CWE-74

TI-2024-28719 CVE-2024-43009 · GHSA-g5p7-39ff-j5mv

A reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24…

MEDIUM 55

A reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.0039 Published 2024-08-16 No fix listed CWE-79

TI-2024-28717 CVE-2024-43005 · GHSA-ffm7-5xwh-8f68

A reflected cross-site scripting (XSS) vulnerability in the component dl_liuyan_save.php…

MEDIUM 55

A reflected cross-site scripting (XSS) vulnerability in the component dl_liuyan_save.php of ZZCMS v2023 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00343 Published 2024-08-16 No fix listed CWE-79

TI-2023-22589 CVE-2023-42398 · GHSA-gcfc-jwhf-63vr

An issue in zzCMS v.2023 allows a remote attacker to execute arbitrary code and obtain…

MEDIUM 52

An issue in zzCMS v.2023 allows a remote attacker to execute arbitrary code and obtain sensitive information via the ueditor component in controller.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01669 Published 2023-09-15 No fix listed CWE-918

TI-2025-16800 CVE-2025-22957 · GHSA-pmc3-v8x7-chwc

A SQL injection vulnerability exists in the front-end of the website in ZZCMS <= 2023…

MEDIUM 50

A SQL injection vulnerability exists in the front-end of the website in ZZCMS <= 2023, which can be exploited without any authentication.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0056 Published 2025-01-31 No fix listed CWE-89

TI-2020-14555 CVE-2020-23426 · GHSA-wf3r-vmmg-hh9p

zzcms 201910 contains an access control vulnerability through escalation of privileges in…

MEDIUM 48

zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify data for further attacks such as CSRF.