CVE-2019-15524

CSZ CMS 1.2.3 contains an arbitrary file upload vulnerability in the File Management Module (admin/filemanager) that enables remote code execution via the URI photo/upload/2019/. Several sources (CNVD, RH/Red Hat, PRION, CVE listings) corroborate RCE potential; no explicit patch/version is provid...

CSZ CMS SQL Injection Vulnerability

CSZ CMS is a PHP-based open source content management system CMS. A SQL injection vulnerability exists in the core/MYSecurity.php file in CSZ CMS version 1.2.2 prior to 2019-06-20. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based application...

CVE-2019-13086

core/MYSecurity.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrfcsz parameter...

CVE-2019-13086

core/MYSecurity.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrfcsz parameter...

Sql injection

core/MYSecurity.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrfcsz parameter...

CVE-2019-13086

core/MYSecurity.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrfcsz parameter...

CVE-2019-13086

CSZ CMS 1.2.2 (before 2019-06-20) contains a SQL injection in core/MY_Security.php at the member/login/check path, triggered by a crafted HTTP User-Agent header and omission of the csrf_csz parameter. Root cause: lack of validation/sanitization in the SQL statement when processing the User-Agent ...

CSZ CMS 1.2.1 Arbitrary File Upload

i?=========================================================================================== Exploit Title: CSZ CMS 1.2.1 - Arbitrary File Upload Dork: N/A Date: 15-03-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.cszcms.com/ Software Link:...

Cross site request forgery (csrf)

CSZ CMS 1.1.8 has CSRF via admin/users/new/add...

CVE-2019-7566

CSZ CMS 1.1.8 has CSRF via admin/users/new/add...

CVE-2019-7566

CSZ CMS 1.1.8 has CSRF via admin/users/new/add...

CVE-2019-7566

CSZ CMS 1.1.8 has CSRF via admin/users/new/add...

CVE-2019-7566

CSZ CMS 1.1.8 contains a CSRF vulnerability in the admin/users/new/add flow. Root cause: improper CSRF protection in the user-creation endpoint. Impact per CVSS3 is HIGH (C/H, I/H, A/H) with NETWORK attack vector, LOW attack complexity, NONE privileges, UI required; authenticated user interaction...