CVE-2018-14962

zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php...

Cross site request forgery (csrf)

zzcms 8.3 has CSRF via the admin/adminadd.php?action=add URI...

CVE-2018-14962

zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php...

Cross site scripting

zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php...

CVE-2018-14961

dl/dlsendmail.php in zzcms 8.3 has SQL Injection via the sql parameter...

CVE-2018-14963

zzcms 8.3 has CSRF via the admin/adminadd.php?action=add URI...

CVE-2018-14962

zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php...

CVE-2018-14961

dl/dlsendmail.php in zzcms 8.3 has SQL Injection via the sql parameter...

CVE-2018-14963

The CVE-2018-14963 entry concerns zzcms 8.3 with a Cross-Site Request Forgery vulnerability exposed via the admin/adminadd.php?action=add URI. According to the provided metrics, the CVSS vectors indicate a network-based vulnerability with high impact to confidentiality, integrity, and availabilit...

CVE-2018-14962

The CVE-2018-14962 entry concerns zzcms 8.3 with a stored XSS vulnerability affecting the content variable in user/manage.php and zt/show.php. Affected component/file paths are specified, and the underlying issue is a stored XSS condition, enabling injection via the content field. The available d...

CVE-2018-14961

SQL Injection in ZZCMS 8.3 (CVE-2018-14961) via the sql parameter in dl/dl_sendmail.php is documented across CNVD-2018-15398 and related sources. The vulnerability arises in ZZCMS’s handling of user-supplied values for the sql parameter, enabling arbitrary SQL execution. CNVD notes that a remote ...

SQL Injection Vulnerability in ZZCMS Website Builder System

zzcms is asp language to do free open-source station-building system, mainly facing the majority of webmasters to use. ZZCMS website builder system there are SQL injection vulnerabilities, attackers can use the vulnerability to obtain sensitive information in the database...

ZZCMS 8.3 suffers from SQL Injection Vulnerability

zzcms is asp language to do free open-source website building system, mainly facing the majority of webmasters to use. ZZCMS website builder system 8.3 SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive database information...

zzcms SQL Injection Vulnerability (CNVD-2018-13893)

ZzCMS is the content management system of Webmaster Merchants. A SQL injection vulnerability exists in /user/del.php in zzcms 8.3. An attacker can exploit this vulnerability by using the zzcmsask table and exploiting SQL injection via the tablename parameter...

ZZCMS Arbitrary File Deletion Vulnerability (CNVD-2018-12559)

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A security vulnerability exists in the /user/del.php file in ZZCMS version 8.3. The vulnerability can be exploited to delete arbitrary files by placing a relative path to the zzcmsmain form and sending a reque...

CVE-2018-13116

/user/del.php in zzcms 8.3 allows SQL injection via the tablename parameter after leveraging use of the zzcmsask table...

CVE-2018-13116

/user/del.php in zzcms 8.3 allows SQL injection via the tablename parameter after leveraging use of the zzcmsask table...

Sql injection

/user/del.php in zzcms 8.3 allows SQL injection via the tablename parameter after leveraging use of the zzcmsask table...

CVE-2018-13116

/user/del.php in zzcms 8.3 allows SQL injection via the tablename parameter after leveraging use of the zzcmsask table...

CVE-2018-13116

CVE-2018-13116 describes an SQL injection in zzcms 8.3 via the path /user/del.php when the attacker manipulates the tablename parameter after leveraging the zzcms_ask table. Multiple sources corroborate: NVD entry notes SQLi with a high/critical impact (CVSS v2: 7.5; CVSS v3: 9.8) affecting confi...