194 matches found
CVE-2021-32605
zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block...
Design/Logic Flaw
zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block...
CVE-2021-32605
zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block...
CVE-2021-32605
zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block...
CVE-2021-32605
The CVE-2021-32605 entry concerns zzzcms/zzzphp before 2.0.4, where the parserIfLabel template processing fails to validate user-provided keys in the ?location=search flow, enabling remote code execution. The vulnerability allows an attacker to run arbitrary OS commands or code via a crafted keys...
PT-2021-19803
Name of the Vulnerable Software and Affected Versions zzzcms zzzphp versions prior to 2.0.4 Description The issue allows remote attackers to execute arbitrary OS commands. This can be achieved by placing OS commands in the keys parameter of a /location=search URI. For example, an OS command can b...
CVE-2021-32605: Improper Neutralization of Special Elements used in an OS Command
zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block...
Zzzcms 操作系统命令注入漏洞
ZZZCMS zzzphp is a content management system CMS. A security vulnerability exists in Zzzcms prior to version 2.0.4. The vulnerability stems from the failure of a network system or product to properly filter special characters, commands, etc. during the execution of user input construction command...
SRC-2021-0015 : zzzcms zzzphp parserIfLabel Template Injection Remote Code Execution Vulnerability
Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of zzzphp. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the search template. The issue results from the lack of...
ZZZCMS zzzphp SQL Injection Vulnerability
ZZZCMS zzzphp is a content management system CMS. A security vulnerability exists in ZZZCMS zzzphp version 1.7.1, which allows remote attackers to exploit the vulnerability to execute arbitrary code...
CVE-2020-18717
SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parameter filtering in inc/zzztemplate.php...
CVE-2020-18717
SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parameter filtering in inc/zzztemplate.php...
Sql injection
SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parameter filtering in inc/zzztemplate.php...
ZZZCMS zzzphp SQL注入漏洞
ZZZCMS zzzphp is a content management system CMS. A security vulnerability exists in ZZZCMS zzzphp version 1.7.1, which allows remote attackers to exploit the vulnerability to execute arbitrary code...
CVE-2020-18717
The CVE-2020-18717 entry concerns ZZZCMS zzzphp 1.7.1, where a SQL injection due to lack of parameter filtering in inc/zzz_template.php allows remote code execution. Public sources classify the impact as high/critical (NVD CVSS v3.1: 9.8; v2: 7.5). The affected component is the zzz_template.php p...
CVE-2020-18717
SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parameter filtering in inc/zzztemplate.php...
CVE-2020-18717: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parameter filtering in inc/zzztemplate.php...
PT-2021-10224
Name of the Vulnerable Software and Affected Versions: ZZZCMS zzzphp version 1.7.1 Description: The issue allows remote attackers to execute arbitrary code due to a lack of parameter filtering in inc/zzz template.php. This enables attackers to inject SQL code, potentially leading to unauthorized...
SQL injection vulnerability exists in zzzzphp (CNVD-2020-67552)
zzcms is a free website builder developed in asp language. There is a SQL injection vulnerability in zzzphp, which can be exploited by attackers to obtain sensitive database information...