CVE-2019-10647

creationtimestamp| type| source ---|---|--- 2025-10-31 21:02:37+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m4jerlkmva2e 2025-12-04 13:05:15+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2018/CVE-2019-10647.yaml 2025-12-06...

CVE-2019-10647

ZZZCMS zzzphp v1.6.3 is vulnerable to remote code execution (RCE) due to a lack of restrictions in inc/zzz_file.php . Attackers can execute arbitrary PHP code by providing a crafted URL in the plugins/ueditor/php/controller.php?action=catchimage source[] parameter. Exploitation requires the attac...