ZZCMS 安全漏洞

ZZCMS is a content management system CMS from the ZZCMS team in China. A security vulnerability exists in ZZCMS v.2023 and previous versions. A remote attacker can exploit the vulnerability to obtain sensitive information via the id parameter in the adv2.php component...

CVE-2024-44821

ZZCMS 2023 contains a vulnerability in the captcha reuse logic in /inc/function.php. The checkyzm function does not properly refresh the captcha value after a failed validation, enabling an attacker to repeatedly submit the same incorrect captcha and potentially infer the correct value via error ...

CVE-2024-44820

CVE-2024-44820 affects ZZCMS v.2023 and earlier. The vulnerability resides in the eginfo.php file located at /3/E_bak5.1/upload/ and is triggered when phome=ShowPHPInfo is supplied, executing phpinfo() and exposing detailed PHP environment information (server config, loaded modules, variables). T...

CVE-2024-44820

A sensitive information disclosure vulnerability exists in ZZCMS v.2023 and before within the eginfo.php file located at /3/Ebak5.1/upload/. When accessed with the query parameter phome=ShowPHPInfo, the application executes the phpinfo function, which exposes detailed information about the PHP...

CVE-2024-44819

Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via a crafted script to the pagename parameter of the admin/del.php component...

CVE-2024-44821

ZZCMS 2023 contains a vulnerability in the captcha reuse logic located in /inc/function.php. The checkyzm function does not properly refresh the captcha value after a failed validation attempt. As a result, an attacker can exploit this flaw by repeatedly submitting the same incorrect captcha...

CVE-2024-44819

The CVE refers to ZZCMS (versions 2023 and earlier) with a Cross-Site Scripting vulnerability in the admin/del.php component via the pagename parameter. The flaw could allow a remote attacker to obtain sensitive information. Source details from PT-Security describe the issue and provide a high-le...

ZZCMS path traversal vulnerability (CNVD-2024-36343)

ZZCMS is a content management system CMS by the ZZCMS team in China. A path traversal vulnerability exists in ZZCMS version 2023, which stems from the parameter skin in the file /admin/class.php?dowhat=modifyclass that causes path traversal. No details of the vulnerability are provided at this ti...

ZZCMS HTTP_REFERER header cross-site scripting vulnerability

ZZCMS is a content management system CMS by the ZZCMS team in China. A cross-site scripting vulnerability exists in ZZCMS v2023 and earlier versions, which stems from incorrect HTTPREFERER header handling, and can be exploited by an attacker to execute malicious scripts via specially crafted URLs...

ZZCMS Directory Traversal Vulnerability (CNVD-2024-38193)

ZZCMS is a content management system CMS by the ZZCMS team in China. Directory traversal vulnerability exists in ZZCMS 2023 and previous versions, the vulnerability stems from insufficient validation and filtering of user-input file paths, which can be exploited by an attacker to delete arbitrary...

ZZCMS content parameter cross-site scripting vulnerability

ZZCMS is a content management system CMS by the ZZCMS team in China. A cross-site scripting vulnerability exists in ZZCMS v2023, which originates from the lack of effective filtering and escaping of user-supplied data in the content parameter of /user/askedit.php?action=add, which can be exploite...

ZZCMS Path Traversal Vulnerability

ZZCMS is a content management system CMS by the ZZCMS team in China. A path traversal vulnerability exists in ZZCMS version 2023, which stems from the parameter skin in the file /admin/aboutedit.php?action=modify that causes path traversal. No details of the vulnerability are provided at this tim...

ZZCMS Arbitrary File Read Vulnerability

ZZCMS is a content management system CMS by the ZZCMS team in China. ZZCMS suffers from an arbitrary file read vulnerability, which is due to a lack of effective validation of file paths and can be exploited by an attacker to perform directory traversal...

CVE-2024-7927

A vulnerability classified as critical was found in ZZCMS 2023. Affected by this vulnerability is an unknown functionality of the file /admin/class.php?dowhat=modifyclass. The manipulation of the argument skin leads to path traversal. The attack can be launched remotely. The exploit has been...

CVE-2024-7927

A vulnerability classified as critical was found in ZZCMS 2023. Affected by this vulnerability is an unknown functionality of the file /admin/class.php?dowhat=modifyclass. The manipulation of the argument skin leads to path traversal. The attack can be launched remotely. The exploit has been...

CVE-2024-7926

A vulnerability classified as critical has been found in ZZCMS 2023. Affected is an unknown function of the file /admin/aboutedit.php?action=modify. The manipulation of the argument skin leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2024-7927 ZZCMS class.php path traversal

A vulnerability classified as critical was found in ZZCMS 2023. Affected by this vulnerability is an unknown functionality of the file /admin/class.php?dowhat=modifyclass. The manipulation of the argument skin leads to path traversal. The attack can be launched remotely. The exploit has been...

CVE-2024-7927

ZZCMS 2023 contains a path traversal flaw in /admin/class.php?dowhat=modifyclass caused by unsafely handling the skin[] parameter. The vulnerability allows remote exploitation and has had the exploit disclosed publicly. Affected component: the modifyclass endpoint; root cause: insufficient input ...

CVE-2024-7927 ZZCMS class.php path traversal

A vulnerability classified as critical was found in ZZCMS 2023. Affected by this vulnerability is an unknown functionality of the file /admin/class.php?dowhat=modifyclass. The manipulation of the argument skin leads to path traversal. The attack can be launched remotely. The exploit has been...

CVE-2024-7926

CVE-2024-7926 is a known path traversal vulnerability affecting ZZCMS 2023. The flaw is in the unknown function of the file /admin/about_edit.php?action=modify, triggered by manipulating the skin parameter, enabling remote exploitation. Public exploit code/details exist, indicating active risk. S...