986 matches found
CVE-2018-17415
zzcms V8.3 has a SQL injection in /user/zselite.php via the id parameter...
CVE-2018-17414
zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter...
CVE-2018-17412
CVE-2018-17412 affects the ZZCMS package, specifically v8.3, with a SQL injection in /user/logincheck.php exploitable via the X-Forwarded-For HTTP header. The issue stems from unsafely incorporating header data into SQL queries, enabling an attacker to execute arbitrary SQL. CVSS data indicates h...
CVE-2018-17413
ZZCMS v8.3 is affected by a cross-site scripting (XSS) vulnerability in /uploadimg_form.php via the noshuiyin parameter. Root cause: unsanitized input leading to HTML/JS injection. Documented impact per sources: ability to inject scripts; CVSS3.0 base score 6.1 (MEDIUM) with user interaction requ...
CVE-2018-17416
A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter...
CVE-2018-17415
zzcms V8.3 has a SQL injection in /user/zselite.php via the id parameter...
CVE-2018-17413
XSS exists in zzcms v8.3 via the /uploadimgform.php noshuiyin parameter...
CVE-2018-17415
The CVE-2018-17415 entry concerns ZZCMS zzcms V8.3, with a SQL injection in /user/zs_elite.php via the id parameter. Connected sources confirm the vulnerable component and cause: an injectable SQL command path through id in the /user/zs_elite.php endpoint. Impact details are reflected in the CVSS...
CVE-2018-17414
CVE-2018-17414 affects zzcms v8.3, with an SQL injection in /user/jobmanage.php via the bigclass parameter. A remote attacker could execute SQL commands due to improper input handling; CNVD-2019-13262 and NVD entries describe the issue and high CVSS impact (3.0: 8.8). No fix/patch details are pro...
CVE-2018-17416
The CVE 2018-17416 entry describes a SQL injection vulnerability in zzcms v8.3, exploitable via the /admin/adclass.php bigclassid parameter. Affected component is the adclass handling in the admin area, where user-supplied bigclassid input enables SQL injection. The NVD/associated records indicat...
CVE-2018-17412
zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header...
ZZCMS Cross-Site Scripting Vulnerability (CNVD-2019-05298)
ZZCMS is a content management system CMS by the ZZCMS team in China. A cross-site scripting vulnerability exists in the 2019 version of ZZCMS, which stems from the inc/stopsqlin.php file accepting mixed case strings, which can be exploited by remote attackers to inject arbitrary web script or HTM...
Design/Logic Flaw
zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT...
CVE-2019-9078
zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT...
CVE-2019-9078
zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT...
CVE-2019-9078
zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT...
CVE-2019-9078
ZZCMS 2019 contains a cross-site scripting (XSS) vulnerability in the inc/stopsqlin.php route, exploitable via the arbitrary user parameter ask.php?do=modify where mixed-case strings like sCrIpT are not blocked. This is documented across multiple sources (CNVD/CNVD-2019-05298 and CVE-2019-9078) w...
CVE-2019-8411
admin/dldata.php in zzcms 2018 2018-10-19 allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal...