1162 matches found
CVE-2018-14961
dl/dlsendmail.php in zzcms 8.3 has SQL Injection via the sql parameter...
CVE-2018-14962
zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php...
CVE-2018-14963
zzcms 8.3 has CSRF via the admin/adminadd.php?action=add URI...
CVE-2018-14962
The CVE-2018-14962 entry concerns zzcms 8.3 with a stored XSS vulnerability affecting the content variable in user/manage.php and zt/show.php. Affected component/file paths are specified, and the underlying issue is a stored XSS condition, enabling injection via the content field. The available d...
CVE-2018-14963
zzcms 8.3 has CSRF via the admin/adminadd.php?action=add URI...
CVE-2018-14963
The CVE-2018-14963 entry concerns zzcms 8.3 with a Cross-Site Request Forgery vulnerability exposed via the admin/adminadd.php?action=add URI. According to the provided metrics, the CVSS vectors indicate a network-based vulnerability with high impact to confidentiality, integrity, and availabilit...
CVE-2018-14961
SQL Injection in ZZCMS 8.3 (CVE-2018-14961) via the sql parameter in dl/dl_sendmail.php is documented across CNVD-2018-15398 and related sources. The vulnerability arises in ZZCMS’s handling of user-supplied values for the sql parameter, enabling arbitrary SQL execution. CNVD notes that a remote ...
CVE-2018-14962
zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php...
CVE-2018-14961
dl/dlsendmail.php in zzcms 8.3 has SQL Injection via the sql parameter...
PT-2018-12838
Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description The issue is related to SQL Injection via the sql parameter in the dl/dl sendmail.php file. Recommendations For version 8.3, consider restricting access to the dl/dl sendmail.php file until a patch is available, a...
PT-2018-12840
Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description The issue is related to a CSRF problem. It affects the admin/adminadd.php endpoint, specifically when the action parameter is set to add. Recommendations For zzcms version 8.3, consider implementing proper CSRF...
CVE-2018-14962: Improper Neutralization of Input During Web Page Generation
zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php...
CVE-2018-14961: Improper Neutralization of Special Elements used in an SQL Command
dl/dlsendmail.php in zzcms 8.3 has SQL Injection via the sql parameter...
PT-2018-12839
Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description The issue is related to stored XSS and is associated with the content variable in the /user/manage.php and /zt/show.php API endpoints. Recommendations For zzcms version 8.3, consider restricting the use of the...
CVE-2018-14963: Cross-Site Request Forgery (CSRF)
zzcms 8.3 has CSRF via the admin/adminadd.php?action=add URI...
ZZCMS 8.3 suffers from SQL Injection Vulnerability
zzcms is asp language to do free open-source website building system, mainly facing the majority of webmasters to use. ZZCMS website builder system 8.3 SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive database information...
SQL Injection Vulnerability in ZZCMS Website Builder System
zzcms is asp language to do free open-source station-building system, mainly facing the majority of webmasters to use. ZZCMS website builder system there are SQL injection vulnerabilities, attackers can use the vulnerability to obtain sensitive information in the database...
ZZCMS Arbitrary File Deletion Vulnerability (CNVD-2018-12559)
ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A security vulnerability exists in the /user/del.php file in ZZCMS version 8.3. The vulnerability can be exploited to delete arbitrary files by placing a relative path to the zzcmsmain form and sending a reque...
zzcms SQL Injection Vulnerability (CNVD-2018-13893)
ZzCMS is the content management system of Webmaster Merchants. A SQL injection vulnerability exists in /user/del.php in zzcms 8.3. An attacker can exploit this vulnerability by using the zzcmsask table and exploiting SQL injection via the tablename parameter...
