CVE-2018-5960

Zenario v7.1 - v7.6 has SQL injection via the Name input field of organizer.php or admin_boxes.ajax.php in the Categories - Edit module.

CVE-2018-18420

Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizer.ajax.php?path=zenario__content%2Fpanels%2Fcontent URI.