CVE-2025-63693

The comment editing template dzz/comment/template/editform.htm in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple contexts, including HTML and JavaScript strings. This allows low-privilege attackers to construct comment content or request parameters and...

CVE-2025-63693

CVE-2025-63693 affects DzzOffice 2.3.x. The vulnerability resides in the comment editing template (dzz/comment/template/edit_form.htm), which does not adequately escape user-controllable data across HTML and JavaScript contexts. This can allow low-privilege attackers to craft comment content or r...

PT-2025-47383

Name of the Vulnerable Software and Affected Versions DzzOffice versions 2.3.x Description The comment editing template in DzzOffice does not properly sanitize user-supplied data when handling HTML and JavaScript strings. This allows a low-privilege attacker to inject and execute arbitrary...

CVE-2025-63694

DzzOffice v2.3.7 and earlier are affected by an SQL Injection vulnerability in the explorer/groupmanage component. The issue, documented across multiple feeds (CVE-2025-63694 and related advisories), affects versions prior to 2.3.8 and could allow manipulation of database queries via that functio...

CVE-2025-63695

DzzOffice v2.3.7 and earlier is vulnerable to an Arbitrary File Upload in /dzz/system/ueditor/php/controller.php. The core issue stems from a file upload mechanism in controller.php that allows uploading arbitrary files, potentially enabling remote code execution or other impact as described in p...

CVE-2025-63694

DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage...

EUVD-2025-198055

DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage...

EUVD-2025-198056

DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php...

CVE-2025-63694

DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage...

dzzoffice_upload

It is an offensive tool for web application exploitation. The re...

EUVD-2021-17137

Malware in sbrugna...

EUVD-2021-26649

Malware in sbrugna...

EUVD-2021-17135

Malware in sbrugna...

EUVD-2021-27376

Malware in sbrugna...

EUVD-2020-11603

Malware in sbrugna...

EUVD-2021-30582

Malicious code in bioql PyPI...

EUVD-2022-46379

Malicious code in bioql PyPI...

EUVD-2023-43553

Malicious code in bioql PyPI...

EUVD-2021-27475

Malicious code in bioql PyPI...

CVE-2024-29273

There is Stored Cross-Site Scripting XSS in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document...