CVE-2021-46377

CSZ CMS 1.2.9 contains a front-end SQL injection vulnerability exploitable through cszcms/controllers/Member.php#viewUser. The issue is documented across multiple sources (CVE-2021-46377) with high severity (CVSSv3.1 base score 9.8; impact to confidentiality, integrity, and availability) and a ne...

CVE-2020-36136

CVE-2020-36136 affects the CSZCMS package from the vendor path cskaza, specifically version 1.2.9. The root cause is a lack of validation of externally supplied SQL statements in the pm_sendmail parameter within csz_model.php, enabling an attacker to perform SQL Injection and potentially access s...

CVE-2023-34545

CSZCMS 1.3.0 has a SQL injection vulnerability exploitable via the p parameter or the search URL, allowing remote attackers to execute arbitrary SQL commands. The CVSSv3.1 base score is 9.8 (CRITICAL) with impact to confidentiality, integrity, and availability. The documents do not specify a vend...

CVE-2023-41436

CVE-2023-41436 (CSZCMS v1.3.0) is a Cross Site Scripting vulnerability where a crafted input in the Additional Meta Tag field of the Pages Content Menu component enables a local attacker to execute arbitrary code in the context of the web application. The NVD entry lists a CVSS v3.1 base score of...

CVE-2023-6303

CSZCMS 1.3.0 contains an XSS in the Site Settings Page, specifically /admin/settings/, triggered by manipulating the Additional Meta Tag with the payload . The vulnerability is remotely exploitable and details have been publicly disclosed (VDB-246129). Several connected sources confirm the affect...

CVE-2023-6302

CSZCMS 1.3.0 has a vulnerability in the File Manager Page templates (viewstemplates) that allows permission issues. The root cause is tied to unknown functionality in the affected templates, enabling remote exploitation with publicly disclosed exploit details. Multiple sources (NVD, CVE records a...