Vulnerabilities

TI-2023-24370 CVE-2023-45555 · GHSA-g7rr-rj9q-jfww

File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary…

MEDIUM 44

File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via a crafted file to the down_url function in zzz.php file.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01057 Published 2023-10-24 No fix listed CWE-434

TI-2023-24369 CVE-2023-45554 · GHSA-4xxx-xjp2-284m

File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary…

HIGH 82

File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via modification of the imageext parameter from jpg, jpeg,gif, and png to jpg, jpeg,gif, png, pphphp.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01982 Published 2023-10-24 No fix listed CWE-434

TI-2023-05139 CVE-2023-5582 · GHSA-9f2j-mp7j-48wf

ZZZCMS Personal Profile Page cross site scripting

LOW 25

A vulnerability, which was classified as problematic, has been found in ZZZCMS 2.2.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00564 Published 2023-10-14 No fix listed CWE-80

TI-2023-04839 CVE-2023-5263 · GHSA-rh86-mfvh-9jv2

ZZZCMS Database Backup File save.php restore permission

HIGH 71

A vulnerability was found in ZZZCMS 2.1.7 and classified as critical.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00744 Published 2023-09-29 No fix listed CWE-275

TI-2020-13675 CVE-2020-19683 · GHSA-7c29-x43x-h624

A Cross Site Scripting (XSS) exists in ZZZCMS V1.7.1 via an editfile action in save.php.

LOW 25

A Cross Site Scripting (XSS) exists in ZZZCMS V1.7.1 via an editfile action in save.php.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00581 Published 2021-12-09 No fix listed CWE-79

TI-2020-13674 CVE-2020-19682 · GHSA-rv4w-qmhg-65pf

A Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user funciton in save.php.

LOW 39

A Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user funciton in save.php.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00543 Published 2021-12-09 No fix listed CWE-352

Vulnerabilities

Filters

File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary…

File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary…

ZZZCMS Personal Profile Page cross site scripting

ZZZCMS Database Backup File save.php restore permission

A Cross Site Scripting (XSS) exists in ZZZCMS V1.7.1 via an editfile action in save.php.

A Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user funciton in save.php.