CVE-2023-41601

CSZ CMS CVE-2023-41601 affects CSZ CMS v1.3.0 with multiple XSS vulnerabilities in install/index.php, exploitable via crafted payloads in the Database Username or Database Host fields. Root cause described as improper handling of these parameters leading to script/HTML injection. Documented impac...

CVE-2020-25391

CSZ CMS 1.2.9 is affected by a cross-site scripting (XSS) vulnerability allowing arbitrary web script/HTML execution via a crafted payload in the New Pages field of the Pages Content module. The CVE-2020-25391 entry is corroborated by multiple sources (NVD, Red Hat advisory, CNVD, CVE list) and l...

CVE-2021-43701

Summary: CSZ CMS 1.2.9 contains a time- and boolean-based blind SQL injection in the export endpoint. The vulnerability is triggered via /admin/export/getcsv/article_db using fieldS[] and orderby parameters, as described by CVE-2021-43701 records across multiple sources (NVD/CVE, CNVD/CNNVD, Expl...

CVE-2019-13086

CSZ CMS 1.2.2 (before 2019-06-20) contains a SQL injection in core/MY_Security.php at the member/login/check path, triggered by a crafted HTTP User-Agent header and omission of the csrf_csz parameter. Root cause: lack of validation/sanitization in the SQL statement when processing the User-Agent ...

CVE-2022-27163

CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_editUser. The issue arises from lack of input validation in that function, enabling attackers to execute arbitrary SQL and potentially access sensitive database data. Documented across multiple sources (e.g., CVE-2022-27163 entri...

CVE-2020-25392

CVE-2020-25392 affects CSZ CMS 1.2.9. The connected sources describe a Cross-Site Scripting (XSS) vulnerability exploitable through a crafted payload entered in the New Article field under the Article plugin, allowing execution of arbitrary web scripts/HTML in a user’s browser. The Red Hat/CNVD e...

CVE-2024-27752

CSZ CMS version 1.3.0 is affected by a Cross Site Scripting (XSS) vulnerability. This flaw allows a remote attacker to execute arbitrary code via the Default Keyword field within the settings function . To mitigate this risk, users should update the software to a version that addresses the issue ...

CVE-2024-27734

A Cross-Site Scripting (XSS) vulnerability exists in CSZ CMS v.1.3.0 , a PHP-based open-source content management system. The root cause is a lack of effective filtering and escaping of user-supplied data within the Site Name field of the Site Settings component. An attacker can exploit this by i...

CVE-2021-37144

CSZ CMS 1.2.9 is reported vulnerable to Arbitrary File Deletion. In PHP, the unlink() call can be driven by user input that may affect the target file path without sufficient sanitization, per multiple records. The available documents confirm the affected product/version and the underlying cause,...

CVE-2022-27165

CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Plugin_manager_setstatus. The issue arises from unvalidated external input in the affected function, enabling an attacker to execute arbitrary SQL and potentially access sensitive database data. Documented across multiple sources (CNVD...

CVE-2024-25414

CVE-2024-25414 affects CSZ CMS v1.3.0, with an arbitrary file upload vulnerability in the /admin/upgrade component. A crafted ZIP file can lead to code execution. The connected PT-2024-20929 entry confirms the vulnerable component and tailors a workaround: temporarily disable the /admin/upgrade f...

CVE-2022-27161

CSZ CMS 1.2.2 is vulnerable to SQL injection via cszcms_admin_Members_viewUsers. Root cause: lack of validation of externally supplied SQL statements, enabling attackers to execute arbitrary SQL and access sensitive database data. CVSS metrics in public records indicate high-severity impact (C/H/...

CVE-2022-27162

CSZ CMS 1.2.2 is vulnerable to SQL injection via cszcms_admin_Members_editUser, caused by unsanitized input in that endpoint. The issue is documented across multiple sources (including CVE-2022-27162) and is rated High/CRITICAL (CVSS v2 7.5, CVSS v3.1 9.8). Exploitation status and concrete remedi...

CVE-2022-27164

CSZ CMS 1.2.2 is vulnerable to SQL Injection in the cszcms_admin_Users_viewUsers function due to lack of input validation. This affects CSZ CMS 1.2.2 and enables attackers to execute arbitrary SQL commands to obtain sensitive database data (per Red Hat, CNVD, CNNVD, and NVD records). The CVE is C...

CVE-2023-38911

Summary of CVE-2023-38911: CSZ CMS 1.3.0 is affected by a cross-site scripting (XSS) vulnerability that can be triggered by a crafted payload in the YouTube URL field under the Gallery parameter of a created gallery. Multiple connected sources confirm the flaw as an XSS issue in CSZ CMS 1.3.0, of...

CVE-2023-38910

CSZ CMS 1.3.0 is affected by a Cross-Site Scripting (XSS) vulnerability (CVE-2023-38910). The weakness arises in the Carousel Wiget/Carousel widget where a crafted payload entered in the Photo URL or YouTube URL fields can execute arbitrary web scripts or HTML. Public references document a stored...

CVE-2020-21250

CSZ CMS v1.2.4 contains an arbitrary file upload vulnerability in the /core/MY_Security.php component (CVE-2020-21250). Multiple connected sources corroborate a file upload issue originating from that specific file, enabling uploads of arbitrary files. Exploitation details are not provided in the...

CVE-2021-26776

CVE-2021-26776 affects CSZ CMS 1.2.9 with a cross-site scripting (XSS) vulnerability in multiple pages via field names. Root cause and exact exploitable conditions are not detailed in the provided documents, but NVD lists CVSS v3.1 base score 5.4 (MEDIUM) and CVSS v2 base score 3.5 (LOW). Connect...

CVE-2021-3224

CSZ CMS 1.2.9 contains a stored XSS in /admin/pages/new via the content parameter. This CVE (CVE-2021-3224) is consistently described across multiple feeds (NVD, CNVD, Red Hat, CNVD CNVD, etc.) as a stored XSS vulnerability in CSZ CMS. The core issue is input in the content field being reflected ...

CVE-2019-7566

CSZ CMS 1.1.8 contains a CSRF vulnerability in the admin/users/new/add flow. Root cause: improper CSRF protection in the user-creation endpoint. Impact per CVSS3 is HIGH (C/H, I/H, A/H) with NETWORK attack vector, LOW attack complexity, NONE privileges, UI required; authenticated user interaction...

CVE-2019-15524

CSZ CMS 1.2.3 contains an arbitrary file upload vulnerability in the File Management Module (admin/filemanager) that enables remote code execution via the URI photo/upload/2019/. Several sources (CNVD, RH/Red Hat, PRION, CVE listings) corroborate RCE potential; no explicit patch/version is provid...

CVE-2020-19786

CVE-2020-19786 : A file upload vulnerability affects CSKaza CSZ CMS version 1.2.2, caused by an insecure crafted PHP file that enables arbitrary command and code execution. The issue is fixed in version 1.2.4. Exploitation is described in public CVE records and references; CVSSv3.1 metrics indica...

CVE-2023-39599

CVE-2023-39599 affects CSZ CMS v1.3.0. The data shows a Cross-Site Scripting (XSS) vulnerability in the Social Settings parameter that can be exploited by a crafted payload to execute arbitrary code. Reported metrics indicate low confidentiality and integrity impact with no availability impact, a...

CVE-2025-29084

A SQL Injection vulnerability exists in CSZ-CMS v.1.3.0 , an open-source web content management system. The flaw resides in the execSqlFile function within the Upgrade.php file, where unauthenticated input is improperly neutralized. This allows a remote attacker to manipulate SQL queries to achie...

CVE-2025-63608

A SQL injection vulnerability exists in CSZ-CMS versions

CVE-2025-29083

CSZ-CMS v.1.3.0 contains a SQL Injection vulnerability within the Plugin_Manager.php file. The root cause is the execSqlFile function, which fails to correctly filter input, allowing a remote attacker to manipulate SQL queries. This flaw can lead to arbitrary code execution . To remediate this, u...

CVE-2021-47738

CSZ CMS 1.2.7 is affected by a persistent XSS in private messages. The vulnerability arises from unsanitized user-agent header data that attackers can inject with JavaScript, which executes when an admin views the message in the backend dashboard. Affected component: handling of the user-agent he...

CVE-2024-58307

CSZCMS 1.3.0 is affected by an authenticated SQL injection in the members view endpoint (view parameter). The vulnerability allows an authenticated attacker to manipulate queries, enabling time-based blind SQL injection and potential extraction of database information. Affected component: members...

CVE-2021-47737

CSZ CMS 1.2.7 exposes an HTML injection vulnerability in the member messaging system. The issue allows authenticated users to inject HTML hyperlinks into message titles by crafting POST requests to the member dashboard, enabling potential phishing or social engineering. Impact is limited to HTML ...