CVE-2020-19042

Cross Site Scripting XSS vulnerability exists in zzcms 2019 XSS via a modify action in user/adv.php...

Cross site scripting

Cross Site Scripting XSS vulnerability exists in zzcms 2019 XSS via a modify action in user/adv.php...

CVE-2020-19042

Cross Site Scripting XSS vulnerability exists in zzcms 2019 XSS via a modify action in user/adv.php...

Improper access control

zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify data for further attacks such as CSRF...

CVE-2020-23426

zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify data for further attacks such as CSRF...

CVE-2018-9331

An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock...