CVE-2024-7924: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in ZZCMS 2023. It has been declared as critical. This vulnerability affects unknown code of the file /I/list.php. The manipulation of the argument skin leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be...

PT-2024-38691 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2023 Description: A problem affects an unknown processing of the file 3/E bak5.1/upload/eginfo.php. The manipulation of the phome argument with the input ShowPHPInfo leads to information disclosure. The attack may be initiated...

PT-2024-38692 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2023 Description: A critical vulnerability has been found in ZZCMS. The issue affects an unknown function of the file /admin/about edit.php?action=modify. The manipulation of the skin argument leads to path traversal. It is...

PT-2024-38690 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2023 Description: A critical vulnerability was found in ZZCMS 2023, affecting unknown code in the file /I/list.php. The manipulation of the skin argument leads to path traversal. This issue can be exploited remotely. The exploit...

CVE-2024-43009

A reflected cross-site scripting XSS vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value of the HTTPREFERER header into the HTML response without proper sanitization. An attacker can exploit this vulnerability by tricking a user...

CVE-2024-43011

An arbitrary file deletion vulnerability exists in the admin/del.php file at line 62 in ZZCMS 2023 and earlier. Due to insufficient validation and sanitization of user input for file paths, an attacker can exploit this vulnerability by using directory traversal techniques to delete arbitrary file...

CVE-2024-43005

A reflected cross-site scripting XSS vulnerability in the component dlliuyansave.php of ZZCMS v2023 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload...

CVE-2024-43009

A reflected cross-site scripting XSS vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value of the HTTPREFERER header into the HTML response without proper sanitization. An attacker can exploit this vulnerability by tricking a user...

CVE-2024-43011

An arbitrary file deletion vulnerability exists in the admin/del.php file at line 62 in ZZCMS 2023 and earlier. Due to insufficient validation and sanitization of user input for file paths, an attacker can exploit this vulnerability by using directory traversal techniques to delete arbitrary file...

CVE-2024-43005

A reflected cross-site scripting XSS vulnerability in the component dlliuyansave.php of ZZCMS v2023 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload...

ZZCMS 安全漏洞

ZZCMS is a content management system CMS by the ZZCMS team in China. A security vulnerability exists in ZZCMS version v2023, which stems from vulnerability to reflective cross-site scripting attacks, where an attacker can execute arbitrary code in a user's browser environment by injecting a...

ZZCMS 安全漏洞

ZZCMS is a content management system CMS by the ZZCMS team in China. Directory traversal vulnerability exists in ZZCMS 2023 and previous versions, the vulnerability stems from insufficient validation and filtering of user-input file paths, which can be exploited by an attacker to delete arbitrary...

ZZCMS 安全漏洞

ZZCMS is a content management system CMS by the ZZCMS team in China. A cross-site scripting vulnerability exists in ZZCMS v2023, which originates from the lack of effective filtering and escaping of user-supplied data in the content parameter of /user/askedit.php?action=add, which can be exploite...

CVE-2024-43005

A reflected cross-site scripting XSS vulnerability in the component dlliuyansave.php of ZZCMS v2023 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload...

CVE-2024-43009

A reflected cross-site scripting (XSS) vulnerability exists in ZZCMS versions 2023 and earlier . The root cause is the improper neutralization of input in the user/login.php file at line 24, where the application directly inserts the value of the HTTP_REFERER header into the HTML response without...

CVE-2024-43005

The ZZCMS v2023 content management system contains a reflected cross-site scripting (XSS) vulnerability within the dl_liuyan_save.php component. This flaw allows an attacker to execute arbitrary code in the context of a user's browser by injecting a crafted payload, which can lead to malicious sc...

CVE-2024-43011

An arbitrary file deletion vulnerability exists in the admin/del.php file (line 62) of ZZCMS (version 2023 and earlier). The root cause is the insufficient validation and sanitization of user-provided file paths, which allows an attacker to employ directory traversal techniques to delete arbitrar...

CVE-2024-43011

An arbitrary file deletion vulnerability exists in the admin/del.php file at line 62 in ZZCMS 2023 and earlier. Due to insufficient validation and sanitization of user input for file paths, an attacker can exploit this vulnerability by using directory traversal techniques to delete arbitrary file...

CVE-2024-43009

A reflected cross-site scripting XSS vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value of the HTTPREFERER header into the HTML response without proper sanitization. An attacker can exploit this vulnerability by tricking a user...

CVE-2024-43005

A reflected cross-site scripting XSS vulnerability in the component dlliuyansave.php of ZZCMS v2023 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload...