CVE-2019-16722

CVE-2019-16722 affects ZZZCMS zzzphp v1.7.2. The vulnerability arises from an insufficient protection mechanism against PHP Code Execution, where a passthru call bypasses a str_ireplace operation. The connected documents consistently describe this flaw across sources (Red Hat, NVD, CVE registries...

ZZZCMS zzzphp input validation error vulnerability

ZZZCMS zzzphp is a content management system CMS. An input validation error vulnerability exists in ZZZCMS zzzphp v1.7.2, which can be exploited by an attacker to execute arbitrary code...

SQL injection vulnerability in zzzzphp backend sa***_co*** method

zzphp is a free website builder developed in PHP language. There is a SQL injection vulnerability in the saco method in the background of zzzphp, which can be exploited by attackers to obtain sensitive information from the database...

SQL injection vulnerability in zzzzphp backend sa***.php page

zzphp is a free website builder developed in PHP language. There is a SQL injection vulnerability in the sa.php page of zzzphp background, which can be exploited by attackers to obtain sensitive database information...

Command Execution Vulnerability in zzzphp V1.7.2 Backend

zzphp is a free website builder developed in PHP language. zzzphp V1.7.2 command execution vulnerability exists in the background, an attacker can exploit the vulnerability to execute arbitrary code...

SQL Injection Vulnerability in zzzphp sm***.php Page

zzphp is a free website builder developed in PHP language. A SQL injection vulnerability exists in the zzzphp sm.php page, which can be exploited by attackers to obtain sensitive information from the database...

Command Execution Vulnerability in zzzzphp Backend

zzphp use PHP+mysql/access/sqlite free building station whole system, support cell phone automatic synchronization. There is a command execution vulnerability in the background of zzzphp. An attacker can exploit the vulnerability to execute commands and gain server privileges...

ZZZPHP foreground search with SQL injection vulnerability

ZZZPHP is a free website builder developed in PHP language. ZZZPHP front-end search SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...

Code Execution Vulnerability in zzzphp v1.6.6

zzphp is a PHP-based content management system CMS. A code execution vulnerability exists in zzzphp v1.6.6, which can be exploited by an attacker to gain control of a web server...

zzzphp cms has an arbitrary file read vulnerability

zzzphp cms is a PHP-based content management system CMS. An arbitrary file read vulnerability exists in zzzphp cms, which can be exploited by an attacker to read arbitrary files...

Arbitrary Code Execution Vulnerability in zzzphp v1.6.6 Backend (CNVD-2019-17281)

zzphp is a free website building system developed using PHP. A code execution vulnerability exists in the backend of zzzphp V1.6.6, which can be exploited by attackers to gain control of the web server...

Arbitrary code execution vulnerability in zzzphp v1.6.6 backend (CNVD-2019-17280)

zzphp is a free website building system developed using PHP. A code execution vulnerability exists in the backend of zzzphp V1.6.6, which can be exploited by attackers to gain control of the web server...

Code execution vulnerability in zzzphp v1.6.6 backend (CNVD-2019-17282)

zzphp is a free website building system developed using PHP. A code execution vulnerability exists in the backend of zzzphp V1.6.6, which can be exploited by attackers to gain control of the web server...

Code execution vulnerability in zzzphp V1.6.4 backend

zzphp is a free website building system developed using PHP. A code execution vulnerability exists in the backend of zzzphp V1.6.4, which can be exploited by attackers to gain control of the web server...

Arbitrary file read vulnerability in zzzphp in***.php file

zzphp is a free website building system developed using PHP. An arbitrary file read vulnerability exists in the zzzphp in.php file. An attacker can exploit the vulnerability to read sensitive information...

ZZZCMS zzzphp code injection vulnerability

ZZZCMS zzzphp is a content management system CMS. A code injection vulnerability exists in ZZZCMS zzzphp v1.6.3, which originates from a network system or product that does not properly filter specific elements of externally entered data during the construction of a code segment. An attacker can...

Code injection

ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source parameter because of a lack of inc/zzzfile.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if th...

CVE-2019-10647

ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source parameter because of a lack of inc/zzzfile.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if th...

CVE-2019-10647

Affected software : ZZZCMS zzzphp v1.6.3. Vulnerability : Remote code execution via a crafted URL in plugins/ueditor/php/controller.php?action=catchimage, due to lack of restrictions in inc/zzz_file.php. Example payloads can cause the server to process PHP code as text. Impact : Attacker can exec...

zzzphp CMS 1.6.1 Cross Site Request Forgery

Exploit Title: Cross-Site Request ForgeryCSRF of zzzphp cms 1.6.1 Google Dork: intext:"2015-2019 zzcms.com" Date: 26/02/2019 Exploit Author: Yang Chenglong Vendor Homepage: http://www.zzzcms.com/index.html Software Link: http://115.29.55.18/zzzphp.zip Version: 1.6.1 Tested on:...