CVE_POC_test

CVEPOCtest Воспроизведение уязвимости CVE-2019-13086 и экспериментальный код POC Исходная информация о CVE: https://vulners.com/cve/CVE-2019-13086 Экспериментальная среда: Архитектура CSZ CMS + php5.4 + MySQL 5.5 + Apache 2.4 Типы уязвимостей: SQL-инъекция Загрузка файлов Краткое описание: В...

CSZ-CMS-Stored-XSS---Site-Settings

CSZ CMS Stored XSS v1.3.0 작성자: Sergio 설명: CSZCMS v.1.3.0의 크로스 사이트 스크립팅XSS 취약점으로 인해 로컬 공격자가 Site Settings 메뉴의 Additional Meta Tag 매개변수에 조작된 스크립트를 삽입하여 임의 코드를 실행할 수 있습니다. 공격 벡터: 스크립팅Scripting: 'Site Settings'의 Additional Meta Tag 입력값에 대한 살균 과정의 취약점으로 인해 사용자가 웹 페이지 및 하위 페이지에 접근할 때 실행되는 JavaScript 코드...

CVE-2026-72601

A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper...

EUVD-2026-56040

A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper...

CVE-2026-72601

A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper...

CVE-2026-72601

CSZ CMS 1.3.2 is affected by a Broken Access Control vulnerability that allows unauthenticated remote attackers to read all form submissions, including PII, via the admin form-submission viewer. The viewer endpoint does not perform authentication and the framework authentication helper fails open...

CVE-2026-72601 CSZ CMS CSZ CMS - Broken Access Control

A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper...

PT-2026-70145

Name of the Vulnerable Software and Affected Versions CSZ CMS version 1.3.2 Description Broken access control allows unauthenticated remote attackers to read all form submissions, including personally identifiable information, through the admin form-submission viewer. This occurs because the view...

CVE-2022-27163

CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcmsadminUserseditUser...

CVE-2022-27164

CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcmsadminUsersviewUsers...

CVE-2021-47738

CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attackers can send messages with script payloads in the user-agent header, which will execute when an admin views the message in the backend...

CVE-2021-47737

CSZ CMS 1.2.7 contains an HTML injection vulnerability that allows authenticated users to insert malicious hyperlinks in message titles. Attackers can craft POST requests to the member messaging system with HTML-based links to potentially conduct phishing or social engineering attacks...

CVE-2021-47737

CSZ CMS 1.2.7 contains an HTML injection vulnerability that allows authenticated users to insert malicious hyperlinks in message titles. Attackers can craft POST requests to the member messaging system with HTML-based links to potentially conduct phishing or social engineering attacks...

CVE-2021-47738

CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attackers can send messages with script payloads in the user-agent header, which will execute when an admin views the message in the backend...

CVE-2021-47738

CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attackers can send messages with script payloads in the user-agent header, which will execute when an admin views the message in the backend...

CVE-2021-47737

CSZ CMS 1.2.7 exposes an HTML injection vulnerability in the member messaging system. The issue allows authenticated users to inject HTML hyperlinks into message titles by crafting POST requests to the member dashboard, enabling potential phishing or social engineering. Impact is limited to HTML ...

CVE-2021-47738

CSZ CMS 1.2.7 is affected by a persistent XSS in private messages. The vulnerability arises from unsanitized user-agent header data that attackers can inject with JavaScript, which executes when an admin views the message in the backend dashboard. Affected component: handling of the user-agent he...

CSZ CMS 跨站脚本漏洞

CSZ CMS is an open source web application by the individual developer Cskaza Bassist that allows managing all content and settings on a website. A cross-site scripting vulnerability exists in CSZ CMS version 1.2.7, which stems from insufficient validation of user-agent header inputs and could lea...

CSZ CMS 跨站脚本漏洞

CSZ CMS is an open source web application by the individual developer Cskaza Bassist that allows managing all content and settings on a website. A cross-site scripting vulnerability exists in CSZ CMS version 1.2.7, which stems from insufficient validation of message header inputs and could lead t...

PT-2025-52837

Name of the Vulnerable Software and Affected Versions CSZ CMS version 1.2.7 Description An HTML injection issue exists in CSZ CMS that permits authenticated users to inject malicious hyperlinks into message titles. Attackers can create POST requests to the member messaging system using HTML-based...