CVE-2018-17413

XSS exists in zzcms v8.3 via the /uploadimgform.php noshuiyin parameter...

CVE-2018-17414: Improper Neutralization of Special Elements used in an SQL Command

zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter...

CVE-2018-17415: Improper Neutralization of Special Elements used in an SQL Command

zzcms V8.3 has a SQL injection in /user/zselite.php via the id parameter...

CVE-2018-17416: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter...

CVE-2018-17413: Improper Neutralization of Input During Web Page Generation

XSS exists in zzcms v8.3 via the /uploadimgform.php noshuiyin parameter...

CVE-2018-17412: Improper Neutralization of Special Elements used in an SQL Command

zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header...

ZZCMS Cross-Site Scripting Vulnerability (CNVD-2019-05298)

ZZCMS is a content management system CMS by the ZZCMS team in China. A cross-site scripting vulnerability exists in the 2019 version of ZZCMS, which stems from the inc/stopsqlin.php file accepting mixed case strings, which can be exploited by remote attackers to inject arbitrary web script or HTM...

CVE-2019-9078

zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT...

CVE-2019-9078

zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT...

Design/Logic Flaw

zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT...

CVE-2019-9078

zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT...

CVE-2019-9078

ZZCMS 2019 contains a cross-site scripting (XSS) vulnerability in the inc/stopsqlin.php route, exploitable via the arbitrary user parameter ask.php?do=modify where mixed-case strings like sCrIpT are not blocked. This is documented across multiple sources (CNVD/CNVD-2019-05298 and CVE-2019-9078) w...

CVE-2019-9078: Improper Neutralization of Input During Web Page Generation

zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT...

CVE-2019-8411

admin/dldata.php in zzcms 2018 2018-10-19 allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal...

CVE-2019-8411

admin/dldata.php in zzcms 2018 2018-10-19 allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal...

Directory traversal

admin/dldata.php in zzcms 2018 2018-10-19 allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal...

CVE-2019-8411

The CVE-2019-8411 entry concerns zzcms (2018 release) where admin/dl_data.php enables a directory-traversal vulnerability. The underlying issue allows remote attackers to delete arbitrary files by crafting filename via action=del&filename=../, exposing an impact on integrity and availability stat...

CVE-2019-8411

admin/dldata.php in zzcms 2018 2018-10-19 allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal...

CVE-2019-8411: Improper Limitation of a Pathname to a Restricted Directory

admin/dldata.php in zzcms 2018 2018-10-19 allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal...

SQL Injection Vulnerability in ZZCMS ad***.php Page

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A SQL injection vulnerability exists in the ZZCMS ad.php page, which can be exploited by attackers to obtain sensitive information from the database...