CVE-2023-41601

CSZ CMS CVE-2023-41601 affects CSZ CMS v1.3.0 with multiple XSS vulnerabilities in install/index.php, exploitable via crafted payloads in the Database Username or Database Host fields. Root cause described as improper handling of these parameters leading to script/HTML injection. Documented impac...

CVE-2021-43701

Summary: CSZ CMS 1.2.9 contains a time- and boolean-based blind SQL injection in the export endpoint. The vulnerability is triggered via /admin/export/getcsv/article_db using fieldS[] and orderby parameters, as described by CVE-2021-43701 records across multiple sources (NVD/CVE, CNVD/CNNVD, Expl...

CVE-2022-27163

CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_editUser. The issue arises from lack of input validation in that function, enabling attackers to execute arbitrary SQL and potentially access sensitive database data. Documented across multiple sources (e.g., CVE-2022-27163 entri...

CVE-2020-25391

CSZ CMS 1.2.9 is affected by a cross-site scripting (XSS) vulnerability allowing arbitrary web script/HTML execution via a crafted payload in the New Pages field of the Pages Content module. The CVE-2020-25391 entry is corroborated by multiple sources (NVD, Red Hat advisory, CNVD, CVE list) and l...

CVE-2019-13086

CSZ CMS 1.2.2 (before 2019-06-20) contains a SQL injection in core/MY_Security.php at the member/login/check path, triggered by a crafted HTTP User-Agent header and omission of the csrf_csz parameter. Root cause: lack of validation/sanitization in the SQL statement when processing the User-Agent ...

CVE-2020-25392

CVE-2020-25392 affects CSZ CMS 1.2.9. The connected sources describe a Cross-Site Scripting (XSS) vulnerability exploitable through a crafted payload entered in the New Article field under the Article plugin, allowing execution of arbitrary web scripts/HTML in a user’s browser. The Red Hat/CNVD e...

CVE-2022-27162

CSZ CMS 1.2.2 is vulnerable to SQL injection via cszcms_admin_Members_editUser, caused by unsanitized input in that endpoint. The issue is documented across multiple sources (including CVE-2022-27162) and is rated High/CRITICAL (CVSS v2 7.5, CVSS v3.1 9.8). Exploitation status and concrete remedi...

CVE-2022-27161

CSZ CMS 1.2.2 is vulnerable to SQL injection via cszcms_admin_Members_viewUsers. Root cause: lack of validation of externally supplied SQL statements, enabling attackers to execute arbitrary SQL and access sensitive database data. CVSS metrics in public records indicate high-severity impact (C/H/...

CVE-2022-27164

CSZ CMS 1.2.2 is vulnerable to SQL Injection in the cszcms_admin_Users_viewUsers function due to lack of input validation. This affects CSZ CMS 1.2.2 and enables attackers to execute arbitrary SQL commands to obtain sensitive database data (per Red Hat, CNVD, CNNVD, and NVD records). The CVE is C...

CVE-2022-27165

CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Plugin_manager_setstatus. The issue arises from unvalidated external input in the affected function, enabling an attacker to execute arbitrary SQL and potentially access sensitive database data. Documented across multiple sources (CNVD...

CVE-2024-27734

CSZ CMS v1.3.0 is affected by a Cross-Site Scripting (XSS) in the Site Settings → Site Name field. The root cause is insufficient filtering/escaping of user-supplied data, enabling an attacker to inject script and potentially execute arbitrary code. CVSS v3.1 base score 6.1 (Medium) with network ...

CVE-2024-25414

CVE-2024-25414 affects CSZ CMS v1.3.0, with an arbitrary file upload vulnerability in the /admin/upgrade component. A crafted ZIP file can lead to code execution. The connected PT-2024-20929 entry confirms the vulnerable component and tailors a workaround: temporarily disable the /admin/upgrade f...

CVE-2024-27752

CSZ CMS v1.3.0 exposes a Cross Site Scripting (XSS) vulnerability that allows a remote attacker to execute arbitrary code via the Default Keyword field in the settings function . The CVSSv3.1 base score is 5.4 (Medium) with network attack vector, low to moderate complexity, and user interaction r...

CVE-2021-37144

CSZ CMS 1.2.9 is reported vulnerable to Arbitrary File Deletion. In PHP, the unlink() call can be driven by user input that may affect the target file path without sufficient sanitization, per multiple records. The available documents confirm the affected product/version and the underlying cause,...

CVE-2023-38911

Summary of CVE-2023-38911: CSZ CMS 1.3.0 is affected by a cross-site scripting (XSS) vulnerability that can be triggered by a crafted payload in the YouTube URL field under the Gallery parameter of a created gallery. Multiple connected sources confirm the flaw as an XSS issue in CSZ CMS 1.3.0, of...

CVE-2023-38910

CSZ CMS 1.3.0 is affected by a Cross-Site Scripting (XSS) vulnerability (CVE-2023-38910). The weakness arises in the Carousel Wiget/Carousel widget where a crafted payload entered in the Photo URL or YouTube URL fields can execute arbitrary web scripts or HTML. Public references document a stored...

CVE-2020-21250

CSZ CMS v1.2.4 contains an arbitrary file upload vulnerability in the /core/MY_Security.php component (CVE-2020-21250). Multiple connected sources corroborate a file upload issue originating from that specific file, enabling uploads of arbitrary files. Exploitation details are not provided in the...

CVE-2021-26776

CVE-2021-26776 affects CSZ CMS 1.2.9 with a cross-site scripting (XSS) vulnerability in multiple pages via field names. Root cause and exact exploitable conditions are not detailed in the provided documents, but NVD lists CVSS v3.1 base score 5.4 (MEDIUM) and CVSS v2 base score 3.5 (LOW). Connect...

CVE-2019-7566

CSZ CMS 1.1.8 contains a CSRF vulnerability in the admin/users/new/add flow. Root cause: improper CSRF protection in the user-creation endpoint. Impact per CVSS3 is HIGH (C/H, I/H, A/H) with NETWORK attack vector, LOW attack complexity, NONE privileges, UI required; authenticated user interaction...

CVE-2021-3224

CSZ CMS 1.2.9 contains a stored XSS in /admin/pages/new via the content parameter. This CVE (CVE-2021-3224) is consistently described across multiple feeds (NVD, CNVD, Red Hat, CNVD CNVD, etc.) as a stored XSS vulnerability in CSZ CMS. The core issue is input in the content field being reflected ...

CVE-2019-15524

CSZ CMS 1.2.3 contains an arbitrary file upload vulnerability in the File Management Module (admin/filemanager) that enables remote code execution via the URI photo/upload/2019/. Several sources (CNVD, RH/Red Hat, PRION, CVE listings) corroborate RCE potential; no explicit patch/version is provid...

CVE-2020-19786

CVE-2020-19786 : A file upload vulnerability affects CSKaza CSZ CMS version 1.2.2, caused by an insecure crafted PHP file that enables arbitrary command and code execution. The issue is fixed in version 1.2.4. Exploitation is described in public CVE records and references; CVSSv3.1 metrics indica...

CVE-2023-39599

CVE-2023-39599 affects CSZ CMS v1.3.0. The data shows a Cross-Site Scripting (XSS) vulnerability in the Social Settings parameter that can be exploited by a crafted payload to execute arbitrary code. Reported metrics indicate low confidentiality and integrity impact with no availability impact, a...

CVE-2025-29084

CSZ-CMS v1.3.0 is affected by a SQL injection in the Upgrade.php file (execSqlFile), enabling a remote attacker to execute arbitrary code. The vulnerability is associated with CVE-2025-29084 and is described consistently across NVD/Red Hat/CNNVD/CVE listings, with no public patch/version details ...

CVE-2025-29083

CSZ-CMS 1.3.0 is affected by an SQL Injection in Plugin_Manager.php (execSqlFile) that can lead to remote code execution. The vulnerability has been described across multiple sources as allowing an attacker to execute arbitrary code, with CVSS Brook 3.1 metrics indicating network access, low atta...

CVE-2021-47738

CSZ CMS 1.2.7 is affected by a persistent XSS in private messages. The vulnerability arises from unsanitized user-agent header data that attackers can inject with JavaScript, which executes when an admin views the message in the backend dashboard. Affected component: handling of the user-agent he...

CVE-2025-63608

CVE-2025-63608 describes a SQL injection in CSZ-CMS

CVE-2024-58307

CSZCMS 1.3.0 is affected by an authenticated SQL injection in the members view endpoint (view parameter). The vulnerability allows an authenticated attacker to manipulate queries, enabling time-based blind SQL injection and potential extraction of database information. Affected component: members...

CVE-2021-47737

CSZ CMS 1.2.7 exposes an HTML injection vulnerability in the member messaging system. The issue allows authenticated users to inject HTML hyperlinks into message titles by crafting POST requests to the member dashboard, enabling potential phishing or social engineering. Impact is limited to HTML ...