CVE-2019-9041

An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzztemplate.php file, the parserIfLabel function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring...

CVE-2019-9041

ZZZCMS 1.6.1 is vulnerable to remote code execution via inc/zzz_template.php: parserIfLabel() filtering is not strict, allowing injection of PHP code (example: {if:assert($_POST[x])} and similar). This can enable arbitrary code execution on affected systems, with CVSS3.0 vector CVSS:3.0/AV:N/AC:L...

CVE-2019-9041

An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzztemplate.php file, the parserIfLabel function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring...

CVE-2019-9041: Improper Neutralization of Special Elements used in an Expression Language Statement

An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzztemplate.php file, the parserIfLabel function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring...

Code execution vulnerability in zzzphp V1.6.0 backend

zzphp is a free website building system developed using PHP. A code execution vulnerability exists in the zzzphp V1.6.0 backend, which can be exploited by an attacker to deposit arbitrary code and execute it...

SQL injection vulnerability in zzzphp V1.6.0 backend sa***.php page

zzphp is a free website building system developed using PHP. zzzphp V1.6.0 SQL injection vulnerability exists in the background sa.php page, which can be exploited by attackers to obtain sensitive information from the database...

Code execution vulnerability in zzzphp V1.6.0 backend

zzphp is a free website building system developed using PHP. zzzphp V1.6.0 code execution vulnerability exists in the background, an attacker can exploit the vulnerability to execute arbitrary code and obtain control of the web server...

SQL injection vulnerability in zzzphp V1.5.9 zzz***.php page

zzphp is a free website building system developed using PHP. zzzphp V1.5.9 version zzz.php page SQL injection vulnerability, an attacker can use the vulnerability to obtain database sensitive information...

Zzzphp V1.5.9 SQL Injection Vulnerability in Background sa***.php File

zzphp is a free website building system developed using PHP. Zzzphp V1.5.9 SQL injection vulnerability exists in the background sa.php file, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in zzzphp sa***.php File

zzphp is a free website building system developed using PHP. A SQL injection vulnerability exists in the zzzphp sa.php file. An attacker can exploit the vulnerability to obtain sensitive information from the database...

CVE-2018-20127

An issue was discovered in zzzphp cms 1.5.8. delfile in /admin/save.php allows remote attackers to delete arbitrary files via a mixed-case extension and an extra '.' character, because for example "php" is blocked but path=F:/1.phP. succeeds...

Code injection

An issue was discovered in zzzphp cms 1.5.8. delfile in /admin/save.php allows remote attackers to delete arbitrary files via a mixed-case extension and an extra '.' character, because for example "php" is blocked but path=F:/1.phP. succeeds...

CVE-2018-20127

An issue was discovered in zzzphp cms 1.5.8. delfile in /admin/save.php allows remote attackers to delete arbitrary files via a mixed-case extension and an extra '.' character, because for example "php" is blocked but path=F:/1.phP. succeeds...

CVE-2018-20127

zzzphp cms 1.5.8 contains a flaw in the del_file function of /admin/save.php that permits remote deletion of arbitrary files via a mixed-case extension and an extra '.' character (e.g., path=F:/1.phP.). Root cause: improper validation of file extensions and path syntax leads to arbitrary file del...

CVE-2018-20127: Improper Input Validation

An issue was discovered in zzzphp cms 1.5.8. delfile in /admin/save.php allows remote attackers to delete arbitrary files via a mixed-case extension and an extra '.' character, because for example "php" is blocked but path=F:/1.phP. succeeds...

PT-2018-15260

Name of the Vulnerable Software and Affected Versions zzzphp cms version 1.5.8 Description An issue was discovered that allows remote attackers to delete arbitrary files. This is possible due to the del file function in the /admin/save.php endpoint, which can be exploited by using a mixed-case...

Code execution vulnerability in zzzphp

zzphp is a free website building system developed using PHP. A code execution vulnerability exists in zzzphp. An attacker can exploit this vulnerability to execute arbitrary php code and directly obtain a webshell...

SQL Injection Vulnerability in zzzphp V1.5.2

zzphp is the use of PHP + ACCESS / MSSQL development of free website building system. A SQL injection vulnerability exists in zzzphp V1.5.2 180910, which can be exploited by an attacker to bypass authentication to log in to the administrator's page, view sensitive information or perform...