239 matches found
CSZ CMS 1.2.7 HTML Injection
Exploit Title: CSZ CMS 1.2.7 - 'title' HTML Injection Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.cszcms.com/ Software Link: https://sourceforge.net/projects/cszcms/ Version: v1.2.7 Description: Authenticated user can inject hyperlink to Backend System Dashboard and Member...
Exploit for SQL Injection in Cszcms Csz_Cms
CVEPOCtest Reproduction of the CVE-2019-13086 vulnerabilit...
CSZ CMS Arbitrary File Upload Vulnerability
CSZ CMS is an open source content management system. An arbitrary file upload vulnerability exists in CSZ CMS 1.2.3. An attacker can exploit this vulnerability by accessing photo/upload/2019/ URI to achieve remote code execution...
CVE-2019-15524
CSZ CMS 1.2.3 allows arbitrary file upload, as demonstrated by a .php file to admin/filemanager in the File Management Module, which leads to remote code execution by visiting a photo/upload/2019/ URI...
Remote code execution
CSZ CMS 1.2.3 allows arbitrary file upload, as demonstrated by a .php file to admin/filemanager in the File Management Module, which leads to remote code execution by visiting a photo/upload/2019/ URI...
CVE-2019-15524
CSZ CMS 1.2.3 allows arbitrary file upload, as demonstrated by a .php file to admin/filemanager in the File Management Module, which leads to remote code execution by visiting a photo/upload/2019/ URI...
CVE-2019-15524
CSZ CMS 1.2.3 contains an arbitrary file upload vulnerability in the File Management Module (admin/filemanager) that enables remote code execution via the URI photo/upload/2019/. Several sources (CNVD, RH/Red Hat, PRION, CVE listings) corroborate RCE potential; no explicit patch/version is provid...
CSZ CMS SQL Injection Vulnerability
CSZ CMS is a PHP-based open source content management system CMS. A SQL injection vulnerability exists in the core/MYSecurity.php file in CSZ CMS version 1.2.2 prior to 2019-06-20. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based application...
CVE-2019-13086
core/MYSecurity.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrfcsz parameter...
CVE-2019-13086
core/MYSecurity.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrfcsz parameter...
Sql injection
core/MYSecurity.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrfcsz parameter...
CVE-2019-13086
core/MYSecurity.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrfcsz parameter...
CVE-2019-13086
CSZ CMS 1.2.2 (before 2019-06-20) contains a SQL injection in core/MY_Security.php at the member/login/check path, triggered by a crafted HTTP User-Agent header and omission of the csrf_csz parameter. Root cause: lack of validation/sanitization in the SQL statement when processing the User-Agent ...
CSZ CMS 1.2.1 Arbitrary File Upload
i?=========================================================================================== Exploit Title: CSZ CMS 1.2.1 - Arbitrary File Upload Dork: N/A Date: 15-03-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.cszcms.com/ Software Link:...
CVE-2019-7566
CSZ CMS 1.1.8 has CSRF via admin/users/new/add...
CVE-2019-7566
CSZ CMS 1.1.8 has CSRF via admin/users/new/add...
Cross site request forgery (csrf)
CSZ CMS 1.1.8 has CSRF via admin/users/new/add...
CVE-2019-7566
CSZ CMS 1.1.8 contains a CSRF vulnerability in the admin/users/new/add flow. Root cause: improper CSRF protection in the user-creation endpoint. Impact per CVSS3 is HIGH (C/H, I/H, A/H) with NETWORK attack vector, LOW attack complexity, NONE privileges, UI required; authenticated user interaction...