Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
185 results · page 3 of 4
Dec 9, 2021An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, abd 2021 in dl/dl_download.php.CVE-2021-40282 · Other software · Zzcms · reported by MITREHigh 8.8
An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, abd 2021 in dl/dl_download.php. when registering ordinary users.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 9, 2021An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dl_print.php when registering ordinary users.CVE-2021-40281 · Other software · Zzcms · reported by MITREHigh 8.8
An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dl_print.php when registering ordinary users.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 9, 2021An SQL Injection vulnerablitly exits in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/dl_sendmail.php.CVE-2021-40280 · Other software · Zzcms · reported by MITREHigh 7.2
An SQL Injection vulnerablitly exits in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/dl_sendmail.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 9, 2021An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/bad.php.CVE-2021-40279 · Other software · Zzcms · reported by MITREHigh 7.2
An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/bad.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 27, 2021CSZ CMS v1.2.4 was discovered to contain an arbitrary file upload vulnerability in the component /core/MY_Security.php.CVE-2020-21250 · Other software · Cszcms · reported by MITRECritical 9.8
CSZ CMS v1.2.4 was discovered to contain an arbitrary file upload vulnerability in the component /core/MY_Security.php.
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2021A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component subzs.php.CVE-2020-19961 · Other software · Zzcms · reported by MITREHigh 7.5
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component subzs.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2021A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl_CVE-2020-19960 · Other software · Zzcms · reported by MITREHigh 7.5
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl_sendsms.php page cookie.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2021A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl_CVE-2020-19959 · Other software · Zzcms · reported by MITREHigh 7.5
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl_sendmail.php page cookie.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2021A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parameter on the /dl/dl_prCVE-2020-19957 · Other software · Zzcms · reported by MITREHigh 7.5
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parameter on the /dl/dl_print.php page.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021A remote code execution (RCE) vulnerability in template_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via the "ml" and "title" pCVE-2020-19822 · Other software · Zzcms · reported by MITREHigh 7.2
A remote code execution (RCE) vulnerability in template_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via the "ml" and "title" parameters.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Aug 25, 2021thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add.CVE-2020-19705 · Other software · Thinkphp-zcms Project · reported by MITRECritical 9.8
thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add.
- Product
- Thinkphp-zcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2021CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion.CVE-2021-37144 · Other software · Cszcms · reported by MITRECritical 9.1
CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink() function is called and user input might affect portions of or the whole affected parameter, which represents the path of the file to remove, without sufficient sanitization.
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2021A cross site scripting (XSS) vulnerability in CSZ CMS 1.2.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'NeCVE-2020-25392 · Other software · Cszcms · reported by MITREMedium 5.4
A cross site scripting (XSS) vulnerability in CSZ CMS 1.2.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'New Article' field under the 'Article' plugin.
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Jul 9, 2021A cross site scripting vulnerability in CSZ CMS 1.2.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'New PageCVE-2020-25391 · Other software · Cszcms · reported by MITREMedium 5.4
A cross site scripting vulnerability in CSZ CMS 1.2.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'New Pages' field under the 'Pages Content' module.
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Jun 3, 2021An issue was discovered in zzcms2020.CVE-2020-35973 · Other software · Zzcms · reported by MITREMedium 5.4
An issue was discovered in zzcms2020. There is a XSS vulnerability that can insert and execute JS code arbitrarily via /user/manage.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2021An issue was discovered in zzcms 2019.CVE-2019-12348 · Other software · Zzcms · reported by MITRECritical 9.8
An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2021Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php.CVE-2020-21342 · Other software · Zzcms · reported by MITREHigh 7.5
Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2021zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrCVE-2021-32605 · Other software · Zzzcms · reported by MITRECritical 9.8
zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzzzcms.comsrcincite.io
Apr 8, 2021zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify data for further attCVE-2020-23426 · Other software · Zzcms · reported by MITRECritical 9.8
zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify data for further attacks such as CSRF.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2021A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass.CVE-2020-24877 · Other software · Zzzcms · reported by MITRECritical 9.8
A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2021CSZ CMS 1.2.9 is affected by a cross-site scripting (XSS) vulnerability in multiple pages through the field name.CVE-2021-26776 · Other software · Cszcms · reported by MITREMedium 5.4
CSZ CMS 1.2.9 is affected by a cross-site scripting (XSS) vulnerability in multiple pages through the field name.
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021A stored cross-site scripting (XSS) vulnerability in cszcms 1.2.9 exists in /admin/pages/new via the content parameter.CVE-2021-3224 · Other software · Cszcms · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in cszcms 1.2.9 exists in /admin/pages/new via the content parameter.
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2021SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parameter filtering in inc/zzz_template.php.CVE-2020-18717 · Other software · Zzzcms · reported by MITRECritical 9.8
SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parameter filtering in inc/zzz_template.php.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2021A blind SQL injection vulnerability exists in zzcms ver201910 based on time (cookie injection).CVE-2020-23630 · Other software · Zzcms · reported by MITREHigh 8.8
A blind SQL injection vulnerability exists in zzcms ver201910 based on time (cookie injection).
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzz_template.php in zzzphp 1.7.2 allows remote attackers to execute arbitCVE-2020-20298 · Other software · Zzzcms · reported by MITRECritical 9.8
Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzz_template.php in zzzphp 1.7.2 allows remote attackers to execute arbitrary commands.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020There is a XSS in the user login page in zzcms 2019.CVE-2020-20285 · Other software · Zzcms · reported by MITREMedium 5.4
There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2019parserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because the danger_key function can be bypassed vCVE-2019-17408 · Other software · Zzzcms · reported by MITRECritical 9.8
parserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because the danger_key function can be bypassed via manipulations such as strtr.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2019ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an str_ireplace operation.CVE-2019-16722 · Other software · Zzzcms · reported by MITRECritical 9.8
ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an str_ireplace operation.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Sep 23, 2019ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading CVE-2019-16720 · Other software · Zzzcms · reported by MITREHigh 7.5
ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading a .htaccess or .php5 file.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Aug 26, 2019CSZ CMS 1.2.3 allows arbitrary file upload, as demonstrated by a .php file to admin/filemanager in the File Management Module, which leads to remote code executCVE-2019-15524 · Other software · Cszcms · reported by MITRECritical 9.8
CSZ CMS 1.2.3 allows arbitrary file upload, as demonstrated by a .php file to admin/filemanager in the File Management Module, which leads to remote code execution by visiting a photo/upload/2019/ URI.
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpastebin.comcszcms.com
Jul 23, 2019zzcms 8.3 and earlier is affected by: SQL Injection.CVE-2019-1010153 · Other software · zzcms · reported by josh@bress.netCritical 9.8
zzcms 8.3 and earlier is affected by: SQL Injection. The impact is: sql inject. The component is: zs/subzs.php.
- Product
- zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 23, 2019zzcms 8.3 and earlier is affected by: File Delete to Code Execution.CVE-2019-1010152 · Other software · zzcms · reported by josh@bress.netCritical 9.8
zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/manage.php line 31-80.
- Product
- zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 23, 2019zzcms 8.3 and earlier is affected by: File Delete to Code Execution.CVE-2019-1010150 · Other software · zzcms · reported by josh@bress.netCritical 9.8
zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: /user/zssave.php.
- Product
- zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 23, 2019zzcms version 8.3 and earlier is affected by: File Delete to Code Execution.CVE-2019-1010149 · Other software · zzcms · reported by josh@bress.netCritical 9.8
zzcms version 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: zzcms File Delete to Code Execution. The component is: user/licence_save.php.
- Product
- zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 23, 2019zzcms version 8.3 and earlier is affected by: SQL Injection.CVE-2019-1010148 · Other software · zzcms · reported by josh@bress.netCritical 9.8
zzcms version 8.3 and earlier is affected by: SQL Injection. The impact is: zzcms File Delete to Code Execution.
- Product
- zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 19, 2019zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell.CVE-2019-1010151 · Other software · zzcms · reported by josh@bress.netCritical 9.8
zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell. The impact is: getshell. The component is: /user/ppsave.php.
- Product
- zzmcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 30, 2019core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrf_cCVE-2019-13086 · Other software · Cszcms · reported by MITRECritical 9.8
core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrf_csz parameter.
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2019ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source[] pCVE-2019-10647 · Other software · Zzzcms · reported by MITRECritical 9.8
ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source[] parameter because of a lack of inc/zzz_file.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if the 192.168.0.1 web server sends the contents of a .php file (i.e., it does not interpret a .php file).
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter.CVE-2018-17416 · Other software · Zzcms · reported by MITREHigh 7.2
A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019zzcms V8.3 has a SQL injection in /user/zs_elite.php via the id parameter.CVE-2018-17415 · Other software · Zzcms · reported by MITREHigh 8.8
zzcms V8.3 has a SQL injection in /user/zs_elite.php via the id parameter.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter.CVE-2018-17414 · Other software · Zzcms · reported by MITREHigh 8.8
zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter.CVE-2018-17413 · Other software · Zzcms · reported by MITREMedium 6.1
XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header.CVE-2018-17412 · Other software · Zzcms · reported by MITRECritical 9.8
zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2019There is a CSRF in ZZZCMS zzzphp V1.6.1 via a /admin015/save.php?act=editfile request.CVE-2019-9182 · Other software · Zzzcms · reported by MITREHigh 8.8
There is a CSRF in ZZZCMS zzzphp V1.6.1 via a /admin015/save.php?act=editfile request. It allows PHP code injection by providing a filename in the file parameter, and providing file content in the filetext parameter.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cnpacketstorm.news
Feb 24, 2019zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT.CVE-2019-9078 · Other software · Zzcms · reported by MITREMedium 5.4
zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2019An issue was discovered in ZZZCMS zzzphp V1.6.1.CVE-2019-9041 · Other software · Zzzcms · reported by MITREHigh 7.2
An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cnexploit-db.com
Feb 17, 2019admin/dl_data.php in zzcms 2018 (2018-10-19) allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal.CVE-2019-8411 · Other software · Zzcms · reported by MITREHigh 7.5
admin/dl_data.php in zzcms 2018 (2018-10-19) allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2019CSZ CMS 1.1.8 has CSRF via admin/users/new/add.CVE-2019-7566 · Other software · Cszcms · reported by MITREHigh 8.8
CSZ CMS 1.1.8 has CSRF via admin/users/new/add.
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2018An issue was discovered in zzzphp cms 1.5.8.CVE-2018-20127 · Other software · Zzzcms · reported by MITREHigh 7.5
An issue was discovered in zzzphp cms 1.5.8. del_file in /admin/save.php allows remote attackers to delete arbitrary files via a mixed-case extension and an extra '.' character, because (for example) "php" is blocked but path=F:/1.phP. succeeds.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Oct 29, 2018An issue was discovered in zzcms 8.3.CVE-2018-18792 · Other software · Zzcms · reported by MITRECritical 9.8
An issue was discovered in zzcms 8.3. SQL Injection exists in zs/zs_list.php via a pxzs cookie.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.