Vulnerabilities > Cszcms > CSZ CMS > Critical
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-02-16 | CVE-2024-25414 | Unrestricted Upload of File with Dangerous Type vulnerability in Cszcms CSZ CMS 1.3.0 An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code via uploading a crafted Zip file. | 9.8 |
| 2022-04-12 | CVE-2022-27165 | SQL Injection vulnerability in Cszcms CSZ CMS 1.2.2 CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Plugin_manager_setstatus | 9.8 |
| 2022-04-12 | CVE-2022-27164 | SQL Injection vulnerability in Cszcms CSZ CMS 1.2.2 CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_viewUsers | 9.8 |
| 2022-04-12 | CVE-2022-27163 | SQL Injection vulnerability in Cszcms CSZ CMS 1.2.2 CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_editUser | 9.8 |
| 2022-04-12 | CVE-2022-27162 | SQL Injection vulnerability in Cszcms CSZ CMS 1.2.2 CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_editUser | 9.8 |
| 2022-04-12 | CVE-2022-27161 | SQL Injection vulnerability in Cszcms CSZ CMS 1.2.2 Csz Cms 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_viewUsers | 9.8 |
| 2021-10-27 | CVE-2020-21250 | SQL Injection vulnerability in Cszcms CSZ CMS 1.2.4 CSZ CMS v1.2.4 was discovered to contain an arbitrary file upload vulnerability in the component /core/MY_Security.php. | 9.8 |
| 2021-07-30 | CVE-2021-37144 | Use of Incorrectly-Resolved Name or Reference vulnerability in Cszcms CSZ CMS 1.2.9 CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. | 9.1 |
| 2019-08-26 | CVE-2019-15524 | Unrestricted Upload of File with Dangerous Type vulnerability in Cszcms CSZ CMS 1.2.3 CSZ CMS 1.2.3 allows arbitrary file upload, as demonstrated by a .php file to admin/filemanager in the File Management Module, which leads to remote code execution by visiting a photo/upload/2019/ URI. | 9.8 |
| 2019-06-30 | CVE-2019-13086 | SQL Injection vulnerability in Cszcms CSZ CMS core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrf_csz parameter. | 9.8 |