986 matches found
Arbitrary User Password Reset and Reflective Cross-site Scripting Vulnerabilities in zzcms System
Webmaster Merchants Content Management System ZZCMS developed by the ZZCMS team, into the database optimization, content caching, AJAX and other technologies, open source, independent functional modules, to facilitate secondary development. zzcms system exists arbitrary user password reset and...
Stored Cross-Site Scripting Vulnerability in ZZCMS Version 8.2
zzcms is a free website builder developed in asp language. A stored cross-site scripting vulnerability exists in the show.php file of zzcms version 8.2, which allows an attacker to insert malicious code into the page to obtain information such as user cookies...
Arbitrary File Deletion Vulnerability in ZZCMS Version 8.2
zzcms is a free website builder developed in asp language. ZZCMS 8.2 version of the usermsg.php file in the arbitrary file deletion vulnerability, an attacker can use the vulnerability to delete arbitrary files...
Configuration file write vulnerability in ZZCMS version 8.2
zzcms is a free website builder developed in asp language. There is a configuration file writing vulnerability in the index.php file of zzcms version 8.2, which can be exploited by an attacker to write some configuration information into the configuration file to gain server privileges...
Reflected Cross-Site Scripting Vulnerability in ZZCMS Version 8.2
zzcms is a free website builder developed in asp language. A reflective cross-site scripting vulnerability exists in the step6.php file in version 8.2 of zzcms, which allows an attacker to construct an XSS statement, perform a pop-up box operation, and obtain information such as a user's cookie...
ZZCMS Information Disclosure Vulnerability
ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A security vulnerability exists in ZZCMS version 8.2. A remote attacker can exploit the vulnerability by sending a direct request to the file 3/qqconnect2.0/API/class/ErrorCase.class.php or...
CVE-2018-7434
zzcms 8.2 allows remote attackers to discover the full path via a direct request to 3/qqconnect2.0/API/class/ErrorCase.class.php or 3/ucenterapi/code/friend.php...
Path traversal
zzcms 8.2 allows remote attackers to discover the full path via a direct request to 3/qqconnect2.0/API/class/ErrorCase.class.php or 3/ucenterapi/code/friend.php...
CVE-2018-7434
zzcms 8.2 allows remote attackers to discover the full path via a direct request to 3/qqconnect2.0/API/class/ErrorCase.class.php or 3/ucenterapi/code/friend.php...
CVE-2018-7434
zzcms 8.2 allows remote attackers to discover the full path via a direct request to 3/qqconnect2.0/API/class/ErrorCase.class.php or 3/ucenterapi/code/friend.php...
CVE-2018-7434
The CVE-2018-7434 issue affects ZZCMS 8.2, described as an information-disclosure/path-traversal vulnerability. A remote attacker can discover the full server path by directly requesting 3/qq_connect2.0/API/class/ErrorCase.class.php or 3/ucenter_api/code/friend.php. Affected component: zzcms core...
PT-2018-18068 · Zzcms · Zzcms
Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: The issue allows remote attackers to discover the full path via a direct request to "3/qq connect2.0/API/class/ErrorCase.class.php" or "3/ucenter api/code/friend.php". Recommendations: For zzcms version 8.2, as ...
zzcms 8.2 任意用户密码修改
zzcms 8.2 任意用户密码修改 漏洞描述 zzcms是一款企业建站程序。 zzcms 8.2版本/one/getpassword.php文件存在漏洞，攻击者可利用该漏洞修改任意用户密码。 漏洞分析 /one/getpassword.php文件第 73行，触发漏洞的关键代码。 elseif$action=="step3" && @$SESSION'username'!='' $passwordtrue = isset$POST'password'?$POST'password':""; $password=md5trim$passwordtrue; query"update...
SQL Injection Vulnerability in zzcms 8.2 user/del.php File
zzcms is an enterprise website builder program It is an enterprise website builder program. zzcms 8.2 version user/del.php file SQL injection vulnerability, attackers can exploit the vulnerability to access or modify the database data...
SQL Injection Vulnerability in zzcms 8.2 user/msg.php File
zzcms is an enterprise website builder program It is an enterprise website builder program. An SQL injection vulnerability exists in the user/msg.php file of zzcms version 8.2, which can be exploited by attackers to access or modify database information...
SQL Injection Vulnerability in zzcms 8.2 user/check.php File
zzcms is an enterprise website builder program It is an enterprise website builder program. An SQL injection vulnerability exists in the user/check.php file of zzcms version 8.2, which can be exploited by attackers to access or modify database data...
zzcms user/askadd.php injection
No description provided by source...
zzcms /user/del. php injection vulnerability
No description provided by source...
Reinstallation Bypass Vulnerability in ZZCMS Version 8.1
ZZCMS is an enterprise website builder. A reinstallation bypass vulnerability exists in ZZCMS version 8.1. The vulnerability is caused by determining whether the lock file is installed at step1, which can be directly submitted by POST to the later steps of the reinstallation, allowing an attacker...