CVE-2022-27125

zbzcms v1.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the neirong parameter at /php/ajax.php...

Improper access control

An incorrect access control issue at /admin/runajax.php in zbzcms v1.0 allows attackers to arbitrarily add administrator accounts...

Design/Logic Flaw

An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

Cross site scripting

zbzcms v1.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the neirong parameter at /php/ajax.php...

Arbitrary file deletion

zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php...

Sql injection

zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php...

Sql injection

zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php...

Design/Logic Flaw

An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-27125

zbzcms v1.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the neirong parameter at /php/ajax.php...

CVE-2022-27125

CVE-2022-27125 affects zbzcms v1.0, with a stored cross-site scripting (XSS) vulnerability exploitable via the neirong parameter in /php/ajax.php. The NVD entry lists potential impact as partial integrity and low confidentiality, with CVSSv3.1 base score 6.1 (NETWORK, LOW ATTACK COMPLEXITY, USER ...

CVE-2022-27126

zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php...

CVE-2022-27126

CVE-2022-27126 involves zbzcms v1.0, where a SQL injection is exploitable via the art parameter in /include/make.php. Root cause is improper handling of the art parameter, enabling crafted input to affect SQL queries. Documented impact ranges from partial confidentiality/integrity/availability to...

CVE-2022-27127

CVE-2022-27127 affects zbzcms v1.0 with a SQL injection vulnerability exploitable via the id parameter on /php/ajax.php. The issue is documented across multiple feeds (NVD, Red Hat, CNVD, CVE lists) and is consistently described as a SQL injection vulnerability originating from the id parameter. ...

CVE-2022-27128

CVE-2022-27128 affects zbzcms v1.0, with an incorrect access control flaw at /admin/run_ajax.php that allows attackers to arbitrarily add administrator accounts. The issue is documented across multiple sources (NVD entry and Red Hat/CNVD/CVE listings) with high impact and severe scores (CVSS v3.1...

CVE-2022-27127

zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php...

CVE-2022-27128

An incorrect access control issue at /admin/runajax.php in zbzcms v1.0 allows attackers to arbitrarily add administrator accounts...

CVE-2022-27129

An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-27129

CVE-2022-27129 affects zbzcms v1.0, where an arbitrary file upload vulnerability in /admin/ajax.php can be exploited to execute arbitrary PHP code via a crafted file. The issue enables remote code execution with no authentication and minimal prerequisites, as indicated by the associated CVSS data...

CVE-2022-27131

An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-27131

CVE-2022-27131 affects zbzcms v1.0, with an arbitrary file upload vulnerability at /zbzedit/php/zbz.php that allows code execution via a crafted PHP file. Connected records from NVD/Red Hat/CNVD/CVE list confirm the vulnerability details across multiple sources; exploitation status and official r...