CVE-2018-8966

An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

Configuration file write vulnerability in ZZCMS version 8.2

zzcms is a free website builder developed in asp language. There is a configuration file writing vulnerability in the index.php file of zzcms version 8.2, which can be exploited by an attacker to write some configuration information into the configuration file to gain server privileges...

CVE-2018-7434

zzcms 8.2 allows remote attackers to discover the full path via a direct request to 3/qqconnect2.0/API/class/ErrorCase.class.php or 3/ucenterapi/code/friend.php...