1162 matches found
CVE-2018-17414
CVE-2018-17414 affects zzcms v8.3, with an SQL injection in /user/jobmanage.php via the bigclass parameter. A remote attacker could execute SQL commands due to improper input handling; CNVD-2019-13262 and NVD entries describe the issue and high CVSS impact (3.0: 8.8). No fix/patch details are pro...
CVE-2018-17412
CVE-2018-17412 affects the ZZCMS package, specifically v8.3, with a SQL injection in /user/logincheck.php exploitable via the X-Forwarded-For HTTP header. The issue stems from unsafely incorporating header data into SQL queries, enabling an attacker to execute arbitrary SQL. CVSS data indicates h...
CVE-2018-17413
XSS exists in zzcms v8.3 via the /uploadimgform.php noshuiyin parameter...
CVE-2018-17416
The CVE 2018-17416 entry describes a SQL injection vulnerability in zzcms v8.3, exploitable via the /admin/adclass.php bigclassid parameter. Affected component is the adclass handling in the admin area, where user-supplied bigclassid input enables SQL injection. The NVD/associated records indicat...
CVE-2018-17415
zzcms V8.3 has a SQL injection in /user/zselite.php via the id parameter...
CVE-2018-17412
zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header...
CVE-2018-17416
A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter...
PT-2019-9467
Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description The issue is related to a SQL injection in the /user/jobmanage.php endpoint via the bigclass parameter. Recommendations For zzcms version 8.3, avoid using the bigclass parameter in the /user/jobmanage.php endpoint...
CVE-2018-17416: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter...
PT-2019-9468
Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description The issue is related to a SQL injection in the /user/zs elite.php endpoint via the id parameter. Recommendations For zzcms version 8.3, avoid using the id parameter in the /user/zs elite.php endpoint until the iss...
PT-2019-9465
Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description The issue is related to a SQL Injection vulnerability. It is located in the /user/logincheck.php file and can be exploited via the X-Forwarded-For HTTP header. Recommendations For zzcms version 8.3, consider...
PT-2019-9466
Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description A security issue exists due to the presence of XSS in the /uploadimg form.php noshuiyin parameter. Recommendations For zzcms version 8.3, avoid using the noshuiyin parameter in the /uploadimg form.php endpoint unt...
CVE-2018-17415: Improper Neutralization of Special Elements used in an SQL Command
zzcms V8.3 has a SQL injection in /user/zselite.php via the id parameter...
CVE-2018-17412: Improper Neutralization of Special Elements used in an SQL Command
zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header...
CVE-2018-17413: Improper Neutralization of Input During Web Page Generation
XSS exists in zzcms v8.3 via the /uploadimgform.php noshuiyin parameter...
CVE-2018-17414: Improper Neutralization of Special Elements used in an SQL Command
zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter...
PT-2019-9469
Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description A SQL injection issue exists via the "bigclassid" parameter in the "/admin/adclass.php" API endpoint. Recommendations For zzcms version 8.3, avoid using the bigclassid parameter in the "/admin/adclass.php" endpoin...
ZZCMS Cross-Site Scripting Vulnerability (CNVD-2019-05298)
ZZCMS is a content management system CMS by the ZZCMS team in China. A cross-site scripting vulnerability exists in the 2019 version of ZZCMS, which stems from the inc/stopsqlin.php file accepting mixed case strings, which can be exploited by remote attackers to inject arbitrary web script or HTM...
