CVE-2022-27133

zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php...

CVE-2022-27133

CVE-2022-27133 affects zbzcms v1.0, exposing an arbitrary file deletion vulnerability via the endpoint /include/up.php. The connected documents corroborate this vulnerability across multiple feeds (NVD, Red Hat, CNVD, etc.), noting the impact as file deletion with a high severity on some CVSS vec...

PT-2022-18235

Name of the Vulnerable Software and Affected Versions zbzcms version 1.0 Description A SQL injection issue was found in zbzcms via the art parameter at the "/include/make.php" API endpoint. Recommendations For zbzcms version 1.0, avoid using the art parameter in the "/include/make.php" endpoint...

PT-2022-18236

Name of the Vulnerable Software and Affected Versions zbzcms version 1.0 Description A SQL injection issue was found in zbzcms via the id parameter at the "/php/ajax.php" API endpoint. Recommendations For zbzcms version 1.0, avoid using the id parameter in the "/php/ajax.php" API endpoint until t...

PT-2022-18240

Name of the Vulnerable Software and Affected Versions zbzcms version 1.0 Description The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability at the "/zbzedit/php/zbz.php" API endpoint, specifically the zbz.php file...

PT-2022-18234

Name of the Vulnerable Software and Affected Versions zbzcms version 1.0 Description A stored cross-site scripting XSS issue was found in zbzcms. The issue is related to the neirong parameter at the "/php/ajax.php" API endpoint. This allows for potential malicious script execution. Recommendation...

PT-2022-18241

Name of the Vulnerable Software and Affected Versions zbzcms version 1.0 Description The issue is related to an arbitrary file deletion vulnerability. This vulnerability can be exploited via the "/include/up.php" API endpoint. Recommendations For zbzcms version 1.0, as a temporary workaround,...

CVE-2022-27127: Improper Neutralization of Special Elements used in an SQL Command

zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php...

CVE-2022-27126: Improper Neutralization of Special Elements used in an SQL Command

zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php...

CVE-2022-27131: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-27128: Undefined Security Weakness

An incorrect access control issue at /admin/runajax.php in zbzcms v1.0 allows attackers to arbitrarily add administrator accounts...

CVE-2022-27133: Undefined Security Weakness

zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php...

zbzcms 安全漏洞

zbzcms Station Helper CMS is a content management website from China Station Helper CMS zbzcms. zbzcms version 1.0 is vulnerable to an access control error, which can be exploited by attackers to arbitrarily add administrator accounts...

zbzcms SQL注入漏洞

zbzcms Station Helper CMS is a content management website of China Station Helper CMS zbzcms Inc. zbzcms version 1.0 has a SQL injection vulnerability, which originates from a SQL injection vulnerability found through the art parameter of /include/make.php. No detailed vulnerability details are...

zbzcms SQL注入漏洞

zbzcms Station Helper CMS is a content management website of China Station Helper CMS zbzcms Inc. zbzcms version 1.0 has a SQL injection vulnerability, which originates from a SQL injection vulnerability found through the id parameter of /php/ajax.php. No detailed vulnerability details are...

zbzcms代码问题漏洞

zbzcms station helper CMS is a content management website of China station helper CMS zbzcms company. zbzcms version 1.0 has an arbitrary file upload vulnerability, which can be exploited by attackers to execute arbitrary code via specially crafted PHP files...

CVE-2022-27125: Improper Neutralization of Input During Web Page Generation

zbzcms v1.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the neirong parameter at /php/ajax.php...

PT-2022-18238

Name of the Vulnerable Software and Affected Versions zbzcms version 1.0 Description The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability at the /admin/ajax.php endpoint. Recommendations For zbzcms version 1.0, as a tempora...

PT-2022-18237 · Zbzcms · Zbzcms

Name of the Vulnerable Software and Affected Versions: zbzcms version 1.0 Description: The issue is related to incorrect access control at the /admin/run ajax.php endpoint, allowing attackers to add administrator accounts arbitrarily. Recommendations: For zbzcms version 1.0, as a temporary...