CVE-2018-13056

The CVE-2018-13056 issue affects zzcms 8.3. A vulnerability in /user/del.php allows deleting arbitrary files by inserting a relative path into the zzcms_main table and triggering an img add request, which can be leveraged to delete install.lock and thereby enable access to the database. The conne...

CVE-2018-13056: Improper Input Validation

An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcmsmain table and then making an img add request. This can be leveraged for database access by deleting install.lock...

Stored XSS Vulnerability in zzcms v8.2

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. There is a stored xss vulnerability in ZZCMS version 8.2, through which an attacker can steal administrator cookie information, combined with csrf to operate the backend and so on...

Arbitrary File Deletion Vulnerability in zzcms

ZzCMS is the content management system of Webmaster Merchants. An arbitrary file deletion vulnerability exists in user/adv.php in zzcms 8.2. A remote attacker can exploit this vulnerability by deleting arbitrary files via a directory traversal sequence in the oldimg parameter. An attacker can...

Directory traversal

An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock...

CVE-2018-9331

An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock...

CVE-2018-9331

An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock...

CVE-2018-9331

An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock...

CVE-2018-9331

CVE-2018-9331 affects zzcms 8.2. The vulnerability is in the user/adv.php endpoint, where the oldimg parameter allows directory traversal to delete arbitrary files. This can be exploited to delete install.lock, potentially enabling access to the database. Public sources in CNVD/Curated CVE entrie...

PT-2018-18988 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: An issue was discovered that allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in the user/adv.php endpoint. This can be leveraged for database access by...

CVE-2018-9331: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock...

CVE-2018-9309

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...

CVE-2018-9309

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...

Sql injection

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...

CVE-2018-9309

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...

CVE-2018-9309

CVE-2018-9309 affects zzcms 8.2, where the id parameter in the dl/dl_sendsms.php request enables SQL injection. The NVD entry documents a high‑risk flaw with CVSS v3.1 base score 9.8 (NETWORK, LOW complexity, no privileges, UI/N user interaction, with HIGH impact on confidentiality, integrity, an...

CVE-2018-9309: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...

PT-2018-18966 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: The issue allows SQL injection via the id parameter in a "dl/dl sendsms.php" request. Recommendations: For zzcms version 8.2, avoid using the id parameter in the "dl/dl sendsms.php" request until the issue is...

ZZCMS 'siteurl' parameter PHP code injection vulnerability

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A security vulnerability exists in ZZCMS version 8.2. The vulnerability can be exploited to inject PHP code by sending 'siteurl' parameter to install/index.php file...

zzcms SQL Injection Vulnerability (CNVD-2018-06859)

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A security vulnerability exists in ZZCMS version 8.2. An attacker can use the 'id' parameter in adv2.php?action=modify request to inject SQL commands and obtain passwords...