1162 matches found
CVE-2019-9078
zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT...
CVE-2019-9078
ZZCMS 2019 contains a cross-site scripting (XSS) vulnerability in the inc/stopsqlin.php route, exploitable via the arbitrary user parameter ask.php?do=modify where mixed-case strings like sCrIpT are not blocked. This is documented across multiple sources (CNVD/CNVD-2019-05298 and CVE-2019-9078) w...
CVE-2019-9078
zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT...
CVE-2019-9078: Improper Neutralization of Input During Web Page Generation
zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT...
PT-2019-19351
Name of the Vulnerable Software and Affected Versions zzcms version 2019 Description The issue concerns a security problem where an attacker can execute arbitrary code. This is possible due to the lack of proper input validation in the ask.php file when the do parameter is set to modify...
CVE-2019-8411
admin/dldata.php in zzcms 2018 2018-10-19 allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal...
Directory traversal
admin/dldata.php in zzcms 2018 2018-10-19 allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal...
CVE-2019-8411
admin/dldata.php in zzcms 2018 2018-10-19 allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal...
CVE-2019-8411
admin/dldata.php in zzcms 2018 2018-10-19 allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal...
CVE-2019-8411
The CVE-2019-8411 entry concerns zzcms (2018 release) where admin/dl_data.php enables a directory-traversal vulnerability. The underlying issue allows remote attackers to delete arbitrary files by crafting filename via action=del&filename=../, exposing an impact on integrity and availability stat...
PT-2019-19018
Name of the Vulnerable Software and Affected Versions zzcms version 2018 Description The issue allows remote attackers to delete arbitrary files via a directory traversal attack. This is achieved by exploiting the action and filename parameters in the admin/dl data.php file. Specifically, the...
CVE-2019-8411: Improper Limitation of a Pathname to a Restricted Directory
admin/dldata.php in zzcms 2018 2018-10-19 allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal...
SQL Injection Vulnerability in ZZCMS ad***.php Page
ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A SQL injection vulnerability exists in the ZZCMS ad.php page, which can be exploited by attackers to obtain sensitive information from the database...
SQL Injection Vulnerability in ZZCMS ad***.php
ZZCMS is a free and open source website building system, mainly facing the majority of webmasters. ZZCMS ad.php SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information database...
Unauthorized Access Vulnerability in Full Version of ZZCMS
ZZCMS is a free and open source website building system, mainly facing the majority of webmasters. ZZCMS full version of unauthorized access vulnerability. The vulnerability stems from the website directory/admin/ad.php logic there are problems , you can directly disable java or use burp to modif...
Arbitrary file deletion vulnerability in ZZCMS full version
ZZCMS is a free and open source website building system, mainly facing the majority of webmasters. ZZCMS full version of the existence of arbitrary file deletion vulnerability. The vulnerability stems from a problem in the logic of admin/dl.php, which leads to the deletion of arbitrary files from...
CVE-2018-18791
An issue was discovered in zzcms 8.3. SQL Injection exists in zs/search.php via a pxzs cookie...
CVE-2018-18786
An issue was discovered in zzcms 8.3. SQL Injection exists in ajax/zs.php via a pxzs cookie...