Code injection

parserIfLabel in inc/zzztemplate.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because the dangerkey function can be bypassed via manipulations such as strtr...

CVE-2019-17408

Affected software: ZZZCMS zzzphp 1.7.3. The issue is in parserIfLabel within inc/zzz_template.php, where the danger_key function can be bypassed (e.g., via strtr), enabling remote attackers to execute arbitrary code. This is the explicit root cause and consequence stated across multiple sources. ...

CVE-2019-17408

parserIfLabel in inc/zzztemplate.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because the dangerkey function can be bypassed via manipulations such as strtr...

CVE-2019-17408: Improper Control of Generation of Code

parserIfLabel in inc/zzztemplate.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because the dangerkey function can be bypassed via manipulations such as strtr...

CVE-2019-16720

ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading a .htaccess or .php5 file...

CVE-2019-16722

ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an strireplace operation...

CVE-2019-16722

CVE-2019-16722 affects ZZZCMS zzzphp v1.7.2. The vulnerability arises from an insufficient protection mechanism against PHP Code Execution, where a passthru call bypasses a str_ireplace operation. The connected documents consistently describe this flaw across sources (Red Hat, NVD, CVE registries...

CVE-2019-16720: Unrestricted Upload of File with Dangerous Type

ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading a .htaccess or .php5 file...

ZZZCMS zzzphp input validation error vulnerability

ZZZCMS zzzphp is a content management system CMS. An input validation error vulnerability exists in ZZZCMS zzzphp v1.7.2, which can be exploited by an attacker to execute arbitrary code...

CVE-2019-16722: Undefined Security Weakness

ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an strireplace operation...

SQL injection vulnerability in zzzzphp backend sa***_co*** method

zzphp is a free website builder developed in PHP language. There is a SQL injection vulnerability in the saco method in the background of zzzphp, which can be exploited by attackers to obtain sensitive information from the database...

SQL injection vulnerability in zzzzphp backend sa***.php page

zzphp is a free website builder developed in PHP language. There is a SQL injection vulnerability in the sa.php page of zzzphp background, which can be exploited by attackers to obtain sensitive database information...

SQL Injection Vulnerability in zzzphp sm***.php Page

zzphp is a free website builder developed in PHP language. A SQL injection vulnerability exists in the zzzphp sm.php page, which can be exploited by attackers to obtain sensitive information from the database...

Command Execution Vulnerability in zzzphp V1.7.2 Backend

zzphp is a free website builder developed in PHP language. zzzphp V1.7.2 command execution vulnerability exists in the background, an attacker can exploit the vulnerability to execute arbitrary code...

Command Execution Vulnerability in zzzzphp Backend

zzphp use PHP+mysql/access/sqlite free building station whole system, support cell phone automatic synchronization. There is a command execution vulnerability in the background of zzzphp. An attacker can exploit the vulnerability to execute commands and gain server privileges...

ZZZPHP foreground search with SQL injection vulnerability

ZZZPHP is a free website builder developed in PHP language. ZZZPHP front-end search SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...

Code Execution Vulnerability in zzzphp v1.6.6

zzphp is a PHP-based content management system CMS. A code execution vulnerability exists in zzzphp v1.6.6, which can be exploited by an attacker to gain control of a web server...

zzzphp cms has an arbitrary file read vulnerability

zzzphp cms is a PHP-based content management system CMS. An arbitrary file read vulnerability exists in zzzphp cms, which can be exploited by an attacker to read arbitrary files...

Arbitrary Code Execution Vulnerability in zzzphp v1.6.6 Backend (CNVD-2019-17281)

zzphp is a free website building system developed using PHP. A code execution vulnerability exists in the backend of zzzphp V1.6.6, which can be exploited by attackers to gain control of the web server...

Arbitrary code execution vulnerability in zzzphp v1.6.6 backend (CNVD-2019-17280)

zzphp is a free website building system developed using PHP. A code execution vulnerability exists in the backend of zzzphp V1.6.6, which can be exploited by attackers to gain control of the web server...